Splunk Enterprise Security

Splunk Enterprise Security: It is possible to customize the Incident Review default search?

hcannon
Path Finder

Enterprise Security automatically loads the Incident Review search to look for Status "All", Owner "All", Security Domain "All", Last 24 hours.

Anyone know a way to change the page to, by default, load only new incidents? Or change the time parameter? I feel like this should be something you can change easily in the app configuration, but I haven't run across anything to edit this pages default incident search.

0 Karma
1 Solution
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...