About ljvc

ljvc · ‎07-29-2025

ES 8.1.1 solved this for us!

ljvc · ‎07-14-2025

Hello hcpr, we did run into the same issue shortly after my previous post, and I forgot to give an update in here. The app "missioncontrol" exposes a few endpoints to do with incidents and investigations, and tracing the behavior of Enterprise Security when fetching comments led us to its OpenAPI spec which you can find at missioncontrol/mcopenapi.yaml. The incidents endpoint, when fed a finding/notable ID, will return a list of comments. I recommend everyone to take a look at the requests in your browser's developer tools when interacting with finding notes on the Analyst Queue to see how the endpoint works. Ultimately, we went that way and implemented a custom command to perform the same requests at search time. This is now working flawlessly for us so far, getting even those notes which have no incident_id or source in mc_notes. Hope this helps!

ljvc · ‎07-01-2025

we are experiencing the same issue, subscribing to this thread in case anyone finds a solution

ljvc · ‎05-13-2025

@randoj unfortunately, I cannot share the exact files. However, you should be able to get the incident id for each finding using its calculated rule_id (compare the eval statement for rule_id/event_id in [Incident Review - Main] in SA-ThreatIntelligence/default/savedsearches.conf) via the mc_incidents collection, which has a field notable_id iirc. Then, use that id as a key against the mc_notes collection, and you can get notes for findings. Hope this clears things up a bit!

ljvc · ‎05-13-2025

Hi @randoj ! We just created a lookup definition manually in a local/transforms.conf, as you would with any other KV Store lookup. Additionally, we needed to do the same for the mc_incidents collection, as it is needed to correlate notable_ids and incident_ids, the latter of which are used in mc_notes. It probably is easier to access the collections using the Python SDK and scripts, but this solution worked for us and required less setup. Hope this helps!

ljvc · ‎04-15-2025

As usual, I figured it out shortly after finally asking. Notes are kept in the mc_notes collection in the missioncontrol app, if anyone else was wondering...

ljvc · ‎04-15-2025

Hi there, we're currently migrating to ES 8 and need to see Work Notes (comments) provided by analysts in some dashboards/reports. Previously, the incident_updates_lookup contained the "comment" field, which held this information, and was easy to access in a search. With ES 8, this was obviously mentioned as a limitation - "The Comments feature available in prior versions of Splunk Enterprise Security is now replaced by an enhanced capability to add notes." How can we access those notes (KV Store/Lookup/...) outside of having to click through the Mission Control/Analyst Queue manually? Where are they stored?

ljvc · ‎10-31-2023

DensityFunction and AutoAnomalyDetection are vastly different algorithms, so different results are to be expected. See Developing the Splunk App for Anomaly Detection | Splunk for more info on the Anomaly Detection App's custom algorithm and Algorithms in the Machine Learning Toolkit - Splunk Documentation for the MLTK's DensityFunction. At least in my testing, the ADESCA/Earthgecko-Skyline stack in the Anomaly Detection App is more prone to alerting on non-cyclical low values when compared to the boundaries generated by the DensityFunction, though I have no good explanation for this behavior as of right now.

ljvc · ‎09-17-2023

You mention the tolerance being influenced by the spike that has occured itself. Are you fitting your algorithm on data which includes the intended outlier? Using only data you consider normal to fit the function would likely solve your issue here. The same goes for continuous re-training via partial_fit; use this only after all new data has been predicted using the old model state. If this is not the issue here, some more information regarding what MLTK algorithm you are planning to use, your current parameter setup and what data you are using for your train/test split might give a better idea as to the root cause of your issue.

ljvc · ‎01-25-2023

Hello Splunk Community! In MLTK version 5.3.1, the streaming_apply feature was removed due to bundle replication performance issues. However, I am currently facing a problem where executing a continuously updated model in a distributed fashion across all available search peers in our Splunk Enterprise setup would be highly beneficial. As information on this former functionality appears sparse, I wanted to inquire regarding best way to handle automatically replicating the trained model to the search peers and executing it there, if it is at all still possible. A previous question asked here (How to export/import/share ML models between Splunk instances and external system? ) hinted at manually copying the model files into the target lookup folder as an alternative to using streaming_apply. With daily updates to the model, this is sadly not an option in our deployment. Thanks for your help! Best regards LJ

Posts	10
Solutions	2
Karma Given	0
Karma Received	3
Member Since	‎10-25-2022

Online Status	Offline
Date Last Visited	‎08-11-2025 11:59 PM

Access Finding/Investigation notes in ES 8

What is Best Practice for streamed apply of MLTK m...

Re: "All time" time range in notable drilldown sea...

Re: Access Finding/Investigation notes in ES 8

Re: "All time" time range in notable drilldown sea...

Re: Access Finding/Investigation notes in ES 8

Re: Access Finding/Investigation notes in ES 8

Re: Access Finding/Investigation notes in ES 8

Access Finding/Investigation notes in ES 8

Re: Discrepancies between MLTK and Splunk App for ...

Re: Detecting rare but obvious spike via MLTK

What is Best Practice for streamed apply of MLTK m...

Join the Conversation