Splunk Enterprise Security

How to fetch configured correlation data, query notable events, including associated correlation rules for an app?

sacumen
Explorer

How to fetch configured correlation data, Query notable events, including associated correlation rules for an app?

0 Karma

rajashekar_s
Path Finder

@sacumen see if the following rest query gives what you are looking for

 

| rest /servicesNS/-/-/saved/searches
| search title=*
| table title cron_schedule eai:acl.owner actions dispatch.earliest_time dispatch.latest_time search

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Query notable events with index=notable.
Correlations rules are stored in the app's savedsearches.conf files.
What other correlation data do you seek?

---
If this reply helps you, an upvote would be appreciated.

indut
Path Finder

Thank you, I had the same query and this answer helped 🙂

0 Karma

sacumen
Explorer

Thanks for responding, but I am trying to fetch all the available correlation data through rest call, is there any api to achieve this in splunk?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Again I ask what correlation data to you seek?
See the REST API manuals for how to get data from Splunk using REST. https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTUM/RESTusing
https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTREF/RESTprolog

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.