Splunk Enterprise Security: Why is the Notable Event Suppressions page showing only 30 out of over 300 Suppressions?

[mparks11]

Hi there,

Just noticed that the Notable Event Suppressions page in Splunk Enterprise Security (Configure --> Incident Management --> Notable Event Suppressions) is only showing 30 out of over 300 suppressions. I can view suppressions under Settings --> Event types in the Web UI, see them in SA-ThreatIntelligence/local/eventtypes.conf, and can see that they're being applied where appropriate.

We recently upgraded to ES 4.1.3 from 4.0.1, so maybe this is somehow related to the upgrade?

Was hoping someone else was seeing something similar and could guide me towards a root cause. Thanks in advance.

[LukeMurphey · Accepted solution]

This is a known issue that was fixed in 4.5.1. I recommend reaching out to Support to get a workaround for your system.

[mparks11]

To increase the number of supressions displayed to the ui edit:
$SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/appserver/static/js/collections/NotableEventSuppressions.js (line 14):

url: "alerts/suppressions",

change it to:

url: "alerts/suppressions?count=-1",

Then _bump the version up one. This will work pending an ES 4.5.1 upgrade.

[mparks11]

OK, thanks for the heads up. Will do!