Splunk ES : macro get_identity4events not returning values from identity in notables

[lakshman239]

Greetings

we have the following versions : Splunk 6.5.2/ES 4.5.0/CIM 4.6.0

When we use the macro on its own in the search, it links and shows expected results. Also, when we use the same correlation search on the search bar [ within ES or general search], it works. However, as part of notable event, it doesn't link to identity and doesn't display the user_first, user_last etc..

Has anyone seen the following issue with the macro? Any pointers?

| makeresults | eval user="VanHelsing" | get_identity4events(user) - works

|datamodel(...) | get_identity4events(user) --works

| .... in correlation search /notable doesn't display all the fields from the identity for that particular user.

Thanks
Laks

[lakshman239 · Accepted solution]

Answering my questions.

For any fields to be available and visible in the incident review screens, it needs to be in /etc/apps/SA-ThreatIntelligence/default/log_review.conf. In the above case, fields like src_user_first, src_user_last are not present and hence they weren't available. So, if we add them in the local/log_review.conf or via GUI (Configure->Incident Management->Incident Review Settings), it works.