Thanks @phanTom . I want to know, if we can use ES's risk modifier action in our playbook to reduce the overall risk score of an entity? If so, should we just negate whatever the finding score that we have received in the splunk notable or there exists any calculation to find out how much risk should be reduced?   ... View more

Thanks @phanTom . I will try sending HTTP request with the help of HTTP app that we have in splunk SOAR and call the external AI. ... View more

Hey, thanks @phanTom . Yes, we are actually trying to summarize the findings and use that as a description while creating the tickets or may be summarize the resolution notes or closure notes added by the analyst and update the same in other tools like Defender, Ticketing tools if we have corresponding alerts or tickets created for the splunk notables. If splunk develops a separate connector (app) for Splunk AI assistant to use in SOAR playbooks that would be definitely helpful. ... View more

I have rule_id and If I split the rule_id with delimiter "@@notable" the first part will match the values of source_guid in notable index.  ... View more

Thanks @gcusello  I tried to run a query something like this: | inputlookup incident_updates_lookup | eval source_guid_in_lookup=mvindex(split(rule_id, "@@notable@"), 0) | join type=left source_guid_in_lookup [ search index=notable | rename source_guid as source_guid_in_lookup ] | table rule_id, source_guid_in_lookup, source_event_id, status By this, I want to fetch the source_event_id(notable_id). If I split the rule_id at "@@notable@" the first part would match the source_guid field in notable index. But when I ran this query, I was not able to get any source_event_id. That column returns no entry. Could you please help me to modify this query?  ... View more

When I tried first query, it did show me the time and severity. But there was no single entry for owner, status and rule_title field. For other two queries, no results at all. ... View more

I tried with index=notable. I couldn't see the status change fields for all the notables. Does splunk store all the changes made to a notable event? Is there anything like audit log which keeps tracks of every changes into the events? ... View more