Going through the audit logs I found this query helpful.   index=_audit action=create_saved_search actions=* app=* disabled=* info=* user=* | table _time savedsearch user action actions app disabled info ... View more

For assets I believe these are the src_ fields that match the asset header such as src_should_update src_is_expected ... View more

Hi Abhi, The difference between the two lookup-addition locations is:  Configure > Data Enrichment > Identity Management = This is specifically for adding asset/identities lists that adhere to the ES headers (https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Formatassetoridentitylist) When you add something here, the lookup table gets added to the `asset_sources` macro which is used in the pipeline to generate the final assets list used to automatically correlate the asset data to events Configure > Content > Content Management > Create New Content > Managed Lookup = This is for general lookup tables that do necessarily have to do with identities/assets management Ideally, you want to define Category/Priority in your asset generating search (Such as LDAP or SecKit). So in theory you could utilize a lookup command with your special lookup table to define Priority and Category for these assets in the asset generating search. That way you can have one master asset list in Identity Management with the correct Categories and Priority. Hope this helps, even if a little.. Joey                       ... View more

Another solution may be to add this (or a macro) at the end of the rule to get the severity from the lookup based on the search name: | lookup correlationsearches_lookup rule_name as $search_name$ OUTPUTNEW severity   ... View more

Notable modular alerts actions values are not written to index=notable. To display severity or priority or urgency, Incident review will perform rest query to get values of correlation search and display in Incident review. However, I believe there is an option to overwrite severity from in-line search of correlation search. just add below line to your correlation search. | eval severity="informational/high/low"   ... View more

(A bit off your specific question but perhaps helpful) The use case library - has data dependencies listed for use cases https://docs.splunk.com/Documentation/ES/6.2.0/Admin/Usecasecontentlibrary   ... View more