Splunk ES Incident Review Suppression

[some_guy]

Having an issue within Splunk ES Incident Review.

The option to suppress events from most correlation searches works fine. A handful of events
do NOT offer the option to suppress.

The offending non-suppressible events are a consequence of the same few correlation searches. No other commonalities exist, as far as I'm able to tell. My user context has full rights to the instance, so I'm stumped.

[AndySplunks]

It appears this article may help you. The section labeled "Suppress notable events from new correlation searches" appears to have the answer to your question.

http://docs.splunk.com/Documentation/ES/2.4/Install/NotableEventSuppression

[AndySplunks]

Did you ever figure this issue out?

[some_guy]

One associated default correlation search for which I cannot suppress notables is 'threat list activity detected'. thanks.

[LukeMurphey]

Do you happen to know which correlation searches this happens with? It might be that they are missing the workflow actions to allow you to suppress them. I can verify if that is the case.