Splunk Enterprise Security

Splunk ES Incident Review Suppression

Path Finder

Having an issue within Splunk ES Incident Review.

The option to suppress events from most correlation searches works fine. A handful of events
do NOT offer the option to suppress.

The offending non-suppressible events are a consequence of the same few correlation searches. No other commonalities exist, as far as I'm able to tell. My user context has full rights to the instance, so I'm stumped.

Path Finder

It appears this article may help you. The section labeled "Suppress notable events from new correlation searches" appears to have the answer to your question.

http://docs.splunk.com/Documentation/ES/2.4/Install/NotableEventSuppression

0 Karma

Path Finder

Did you ever figure this issue out?

0 Karma

Path Finder

One associated default correlation search for which I cannot suppress notables is 'threat list activity detected'. thanks.

Champion

Do you happen to know which correlation searches this happens with? It might be that they are missing the workflow actions to allow you to suppress them. I can verify if that is the case.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!