Splunk Enterprise Security

Splunk Enterprise Security: Is there a way to write a search to identify when there is already an existing notable event?

eliyyah
Explorer

If this has already been covered, please provide a link, but I haven't seen anything. My organization uses Splunk Cloud and we have Enterprise Security installed. Does anyone know if there is a way to configure a search to identify when there is already an existing created notable event? As we identify things of interest or things that we'd like to pursue on a day-to-day basis in our logs, we'd like to prevent multiple investigations of the same targets and would like to configure a search to include or exclude those events.

Thanks!

0 Karma
1 Solution

haley_swarnapat
Path Finder

It seems that my suggestion works, now I repost as answer to get karma 🙂

index=notable | TABLE host rule_title creator owner status

View solution in original post

jonasmeier
Explorer

Does not seem to work for me (ES 4.7.2 and above) and it is clear why: owner and status are not saved in the notable index but in a kv store lookup. To lookup these fields you can use the macro "notable"
So this works for me:

`notable`  | TABLE host search_name rule_title owner status
0 Karma

haley_swarnapat
Path Finder

It seems that my suggestion works, now I repost as answer to get karma 🙂

index=notable | TABLE host rule_title creator owner status

haley_swarnapat
Path Finder

Is this what you mean?

index=notable | TABLE host rule_title creator owner status

eliyyah
Explorer

I think we can work with this, thank you very much. Now all we'll have to do is figure out exactly how we can use it to accomplish our goals.

Thanks again guys appreciate your help!

0 Karma

draracle
Engager

Are you asking for a search that would show something like the following? This would be fantastic -- I have no idea if it can be done though.

[Host Name] [Threat Reason] [Notable Event Assigned/In-Process?] [Person Working Case]
ABC123 Malware Yes John Smith

0 Karma

eliyyah
Explorer

Yeah that'd be great, can someone take a look at this? Anything with the notable event for the new version of ES (and we're currently using Splunk 6.4.1.2 and ES version 4.2.0).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...