Splunk Enterprise Security

Splunk Resilient - closing Splunk events

New Member

We have our Splunk - Resilient integration mostly working and wanted to add a script in Resilient to update the status of Notables. It seems that not all of the notable events we are sending to Resilient contain a notable event_id.

We used the following search to send events (every 5 minutes):

`notable` | where isnull(notable_xref)

It looked like maybe we were picking up the Short Id being modified, so I did try this:

`notable`| where NOT like (notable_xref_name, "resilient%")

Still no joy, some events passed to Resilient do not contain the event_id, even though everything seems to work properly and I see the event_id in the notable events in Splunk - even though it didn't make it to Resilient.

Any tips on further troubleshooting?

0 Karma