Splunk ITSI

ack button not show in ITSI Episode review after upgrade from 3.0.1

lightech1
Path Finder

Hello Team,

We have upgraded ITSI version from 3.01 to 4.03. We have some alerts in "correlation searches" that when it triggers generates a notable events, now with the new version, this impacts on the "episode review " tab.

But when the operators clic or view some alert, the ack or assign button doesn't appear, let me show a screenshot:

alt text

We have tried to create again the alert, use another browser, different versions of java, etc.

Thanks in advance!

0 Karma

szhou_splunk
Splunk Employee
Splunk Employee

From ITSI 4.0, you can ack an Episode but not for event, you can set Episode View to On to see the list of episode. Episode is a group of events so you don't have to do the operation for every event one by one.
Please see https://docs.splunk.com/Documentation/ITSI/4.1.2/User/OverviewofITSINotableEventsReview for more information.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...