Splunk Enterprise Security

Splunk Enterprise Security: How to remove a notable event from the "Security Posture" dashboard after investigation?

mgrosholz
Path Finder

I have a notable event seen in Splunk Enterprise Security's Security Posture dashboard.

I have reviewed it and determined it to be a false positive.
I want to remove it from view on the Security Posture dashboard.

Is there any way to do this?

Azeemering
Builder

What you could try is index=notable rule_title="your_notable_event_title" | delete

apcsplunk
Explorer

This worked for me 🙂

index=notable search_name="*your notable title*" | delete 
0 Karma

supreetsingh
New Member

Click the Edit-> Edit Panels in the Security Posture Dashboard.
Under the Top Notable Events, click the search report and select Notable-Top Events and select Open in Search. Add status_group="New" to this search:

| `es_notable_events` | search timeDiff_type=current status_group="New" | stats sparkline(sum(count),30m) as sparkline,sum(count) as count by rule_name | sort 100 - count

Click Save, Save Dashboard. click Done
The Security Posture Dashboard will only show New Notable events

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

In the current form, there is no easy way to delete a notable event. The basic idea here is that event your false positives, you want to categorize. So you could create a new class for false positives and classify these notables into this.

See here : http://docs.splunk.com/Documentation/ES/4.1.1/User/NotableEvents

If you're really looking to delete the events, you'll need to look at the incident_review and notables macros, and where they are pulling the data from. In the latest versions of ES, notables are stored between KVStore, lookup files, and summary indexes..

0 Karma

mgrosholz
Path Finder

I don't want to make all the alerts false positives. Just the specific event that was investigated.

Would grouping them into a new class push all like events there? Or just that event?

Also, deleting the events, as you mentioned above, would delete all the notable events of the same kind; correct?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can go through the events singularly, and either mark them as false / true, or delete them.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...