Splunk Enterprise Security (ES) - How to do a field lookup for Notable Events?

[JohannLiebert92]

Hi everyone,

I am creating a workflow action that allows me to links to a website (e.g. google.com) from Incident Review dashboard. The problem is, in order to use the workflow action, I need to pass a field that is available from a lookup file (based on event_id). May I know how to do lookup for the notable events?

Thanks

[martin_mueller · Accepted solution]

If you intend to use the workflow action from Incident Review or similar pages, that lookup would need to be called from within the notable macro... that macro makes sure the event_id is computed, and therefore your lookup can only be added afterwards.

Then you can use the lookup's output fields in your workflow action as usual.

Caution: Make sure any changes to the default macro made in any upgrade of ES versions also gets replicated in your local copy.

[JohannLiebert92]

Ah I see..thanks for the detailed explanations!