Splunk Enterprise Security

Trying to set default disposition of a notable correlation search



I've been trying to build a correlation search that sets a default disposition value when it runs but so far it doesnt work as advertised.  I've tried this one of two ways:


1) manually setting it to a valid value e.g.



| eval disposition="disposition:7"
| eval disposition_label="My cool disposition label"



2) by editing the correlation search in the advanced search editor and setting the parameter myself:


I've tried this with and without quotes, but I still always get a disposition:6 set by default.


I have validated that this disposition and label does exist and is enabled in Incident Review settings, and can manually be set.

Can someone shine some light on what I'm doing wrong?

Many thanks!

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...