Splunk Enterprise Security

Splunk Enterprise Security: Is there a way to write a search to identify when there is already an existing notable event?

eliyyah
Explorer

If this has already been covered, please provide a link, but I haven't seen anything. My organization uses Splunk Cloud and we have Enterprise Security installed. Does anyone know if there is a way to configure a search to identify when there is already an existing created notable event? As we identify things of interest or things that we'd like to pursue on a day-to-day basis in our logs, we'd like to prevent multiple investigations of the same targets and would like to configure a search to include or exclude those events.

Thanks!

0 Karma
1 Solution

haley_swarnapat
Path Finder

It seems that my suggestion works, now I repost as answer to get karma 🙂

index=notable | TABLE host rule_title creator owner status

View solution in original post

jonasmeier
Explorer

Does not seem to work for me (ES 4.7.2 and above) and it is clear why: owner and status are not saved in the notable index but in a kv store lookup. To lookup these fields you can use the macro "notable"
So this works for me:

`notable`  | TABLE host search_name rule_title owner status
0 Karma

haley_swarnapat
Path Finder

It seems that my suggestion works, now I repost as answer to get karma 🙂

index=notable | TABLE host rule_title creator owner status

haley_swarnapat
Path Finder

Is this what you mean?

index=notable | TABLE host rule_title creator owner status

eliyyah
Explorer

I think we can work with this, thank you very much. Now all we'll have to do is figure out exactly how we can use it to accomplish our goals.

Thanks again guys appreciate your help!

0 Karma

draracle
Engager

Are you asking for a search that would show something like the following? This would be fantastic -- I have no idea if it can be done though.

[Host Name] [Threat Reason] [Notable Event Assigned/In-Process?] [Person Working Case]
ABC123 Malware Yes John Smith

0 Karma

eliyyah
Explorer

Yeah that'd be great, can someone take a look at this? Anything with the notable event for the new version of ES (and we're currently using Splunk 6.4.1.2 and ES version 4.2.0).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...