Can I customized the fields that I see for an incident ticket for the notable event in the incident review dashboard. For example if I want to assign the compliance field that shows its for PCI/SOX/HIPPA/GLBA....etc ... View more

Is it possible to add/attach new events that are generated using correlation searches or manually searches to an existing ticket/incident which got auto created by the incident review dashboard? ... View more

I am trying to understand if I can track changes related to the incidents managed by the ES App.Below are my requirements For Example, lets say the correlation search generates an incident in the incident review dashboard with the title of the incident as " Root login Failed" and automatically assigns the ticket to a security analyst automatically as configured on the correlation search rule. As part of the investigation if the analyst thinks this is not a "Root login Failed" incident but a " excessive failed login" can he manually change the title of the incident that was automatically generated with a different title. And also how can someone track these changes to monitor who and what has changed? Also, similar can it also be done on the Splunk core App as well. ... View more

As I understand the splunk app for Enterprise Security creates a number of TSIDX namespaces that are used to store summary statistical data used by the dashboards and correlation searches throughout the app. And I guess the limit for the length of time that namespaces are retained is specified in the $SPLUNK_HOME/etc/apps/ /default/tsidx_retention.conf file. The only available namespace that i see for notable events is the "sa_notables" I am trying to understand if this is the namespace that the incident review dashboard uses to store all its incidents and also would like to know if all the tickets that are managed by the incident review dashboards are also stored in the same name space and how to setup a retention to store all the tickets that my security operations have worked on ... View more

The ES App currently configured to run few correlation searches and when the notable events are created those events can be assigned to an owner(Analyst 1) under the incident review dashboard for further investigation at this point the incident is changed from "new" to "in progress". lets say the Analyst 1 is unable to resolve and close the incident . how can I assign the same incident to a different owner ( Analyst 2) to perform second level investigation by capturing every thing the first level analyst did so far . Secondly, is there a way to find out metrics about how long the first level analyst took to resolve or re-assign the notable event to a 2nd level support and also to find how long it took to resolve and close the notable events by both the 1st/2nd and 3rd level security analysts? ... View more

Can I create a security operations workflows using the ES app? For example, if I want a ticket to be opened in the ticketing system etc. how do i do that in ES app. ... View more