Splunk ES - Correlation search Vs normal saved search ?

[splunker12er]

Splunk ES -

What does correlation search do much than a savedsearch in this app ?

[I see the Correlation search page is similar to a savedsearch page where some extra options like urgency,rule description, owner,etc are created - which will be output when that search is matched]

Splunk technology add-ons are used to parse the device logs in Splunk.
saved searches (i.e Correlation searches) are fired (in realtime or scheduled) to populate some addition fields and display the results .

Flow example:- Palo alto firewall -> generate logs -> UDP -> reaches splunk-> parsed with PAN sourcetype (TA-PAN) ) -> Data resides in Index -> savedsearches are fired -> Results are displayed

Results will contain some extra fields , using lookup efficiently to populate some more additional information specific to events.

Tell me some more uniqueness of this app ?

[sbrant_splunk]

You are correct that correlation searches utilize the same saved searches that core Splunk does. If you were simply populating dashboards with the results, then correlation searches would not offer a great deal of benefit over simple saved searches.

Within the Enterprise Security product, when a correlation search triggers, the result is a "notable event", which can be tracked and managed via workflow, by a security operations team. So, there are the interactive components, useful to a security operations team, that ES offers. Notes can be added to the notable events, ownership can be assigned, as well as status.

Of course, this makes no mention of the other features of Enterprise Security, such as integration of threat lists and integration of an environments assets and identities information.