Splunk Enterprise Security

Trying to set default disposition of a notable correlation search



I've been trying to build a correlation search that sets a default disposition value when it runs but so far it doesnt work as advertised.  I've tried this one of two ways:


1) manually setting it to a valid value e.g.



| eval disposition="disposition:7"
| eval disposition_label="My cool disposition label"



2) by editing the correlation search in the advanced search editor and setting the parameter myself:


I've tried this with and without quotes, but I still always get a disposition:6 set by default.


I have validated that this disposition and label does exist and is enabled in Incident Review settings, and can manually be set.

Can someone shine some light on what I'm doing wrong?

Many thanks!

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...