Splunk Enterprise Security

the differences between "es_notable_events" and "incident_review_lookup"

kanam
Loves-to-Learn Everything

I'd like to search the status of Incident Review, and have found 2 ways to do it.
1)| inputlookup append=T es_notable_events
2)| inputlookup append=T incident_review_lookup

Other than above 2 ways, many person may look to use "|incident_review" for that.
Maybe "|incident_review" contains 2)| inputlookup append=T incident_review_lookup.

Ideally, I want to display detail information like rule_title,src,user etc.
So I guess 1)| inputlookup append=T es_notable_events is better.
However I'd like to know the differences between "es_notable_events" and "incident_review_lookup".

Best Regards,

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Your best would be to use the notable macro and get required fields, `notable | fields rule_title, search_name`

0 Karma