Splunk Enterprise Security

Trying to set default disposition of a notable correlation search

mjones414
Contributor

Greetings.

I've been trying to build a correlation search that sets a default disposition value when it runs but so far it doesnt work as advertised.  I've tried this one of two ways:

 

1) manually setting it to a valid value e.g.

 

 

| eval disposition="disposition:7"
| eval disposition_label="My cool disposition label"

 

 

2) by editing the correlation search in the advanced search editor and setting the parameter myself:

mjones414_0-1651613713195.png

I've tried this with and without quotes, but I still always get a disposition:6 set by default.

 

I have validated that this disposition and label does exist and is enabled in Incident Review settings, and can manually be set.

Can someone shine some light on what I'm doing wrong?

Many thanks!

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...