Hi all, I’m running Splunk Enterprise Security 8.7.0 on Splunk Enterprise 10.2.3 . I can’t move findings out of team-based queues I created myself to another queue, and I can’t find the cause in the docs.  I can move findings from the default analyst queue to another queue without any trouble but In the custom team-based queues(I have created 2 queues), I select a finding, but the “Move to new queue” action doesn’t appear. I checked the More menu in the selection bar and scrolled to the bottom of the three-dot menu in the finding side panel, and it isn’t in either. I’m using an admin account. What I’ve verified (per the docs for moving findings between queues) 1.“Allow users to move items to other queues” is enabled on both the source and the destination queue (Configure → Findings and investigations → Team queues → About). 2.The Roles tab on both queues shows “All users have full access to this queue”. 3.The findings are not in any investigation or finding group.  ... View more

I'm experiencing a status synchronization issue in Splunk Enterprise Security 8.3.2 where the notable event status displays differently between the incident list and the detailed event view. Issue Details: In the Incident Review list, the event shows status as "New" When navigating to the details of the same event, the status displays as "In Progress" This creates confusion regarding the actual current status of the event ... View more