Splunk Enterprise Security

Merge similar Notable events into one under Incident Review

neerajs_81
Path Finder

Hi All,

Under Incident Review, is there a way to merge/consolidate  triggered alerts of the same type and same host into one ?  By default it shows every single alert even though its from same Host/IP and of same type. We would like to consolidate similar ones into one common alert and then have it  display the total counts of events next to that alert ?

Labels (3)
0 Karma
1 Solution

ro_mc
Explorer

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

View solution in original post

ro_mc
Explorer

There's several ways to accomplish this goal.

1. Use aggregating functions like stats or transaction to group by a field. E.g. " | stats count" or " | transaction src dest". "stats values(field) as Field" can group field values without splitting by row. If using more than one values field (e.g. src and dest), and a row contains multiple src AND dest values, refer to raw events to ascertain which src matches with which dest.

2. Use window duration to ignore duplicate events for a period of time based on the fields you specify. In this case, you may want to configure "Next Steps" for additional searches to run as part of initial analysis and triage.

3. Enable the event sequencing engine from Configure -> General -> General Settings, and configure notable events using event sequence templates. Each Host/IP/type combination will still be returned, but you can use additional correlation searches to narrow down the results and prevent the notable from firing as frequently.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!