Splunk Enterprise Security

Splunk Enterprise Security: Why is the Notable Event Suppressions page showing only 30 out of over 300 Suppressions?

mparks11
Path Finder

Hi there,

Just noticed that the Notable Event Suppressions page in Splunk Enterprise Security (Configure --> Incident Management --> Notable Event Suppressions) is only showing 30 out of over 300 suppressions. I can view suppressions under Settings --> Event types in the Web UI, see them in SA-ThreatIntelligence/local/eventtypes.conf, and can see that they're being applied where appropriate.

We recently upgraded to ES 4.1.3 from 4.0.1, so maybe this is somehow related to the upgrade?

Was hoping someone else was seeing something similar and could guide me towards a root cause. Thanks in advance.

0 Karma
1 Solution

LukeMurphey
Champion

This is a known issue that was fixed in 4.5.1. I recommend reaching out to Support to get a workaround for your system.

View solution in original post

LukeMurphey
Champion

This is a known issue that was fixed in 4.5.1. I recommend reaching out to Support to get a workaround for your system.

mparks11
Path Finder

To increase the number of supressions displayed to the ui edit:
$SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/appserver/static/js/collections/NotableEventSuppressions.js (line 14):

url: "alerts/suppressions",

change it to:

url: "alerts/suppressions?count=-1",

Then _bump the version up one. This will work pending an ES 4.5.1 upgrade.

0 Karma

mparks11
Path Finder

OK, thanks for the heads up. Will do!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...