Splunk Enterprise Security

Splunk ES : macro get_identity4events not returning values from identity in notables

lakshman239
Influencer

Greetings

we have the following versions : Splunk 6.5.2/ES 4.5.0/CIM 4.6.0

When we use the macro on its own in the search, it links and shows expected results. Also, when we use the same correlation search on the search bar [ within ES or general search], it works. However, as part of notable event, it doesn't link to identity and doesn't display the user_first, user_last etc..

Has anyone seen the following issue with the macro? Any pointers?

| makeresults | eval user="VanHelsing" | get_identity4events(user) - works

|datamodel(...) | get_identity4events(user) --works

| .... in correlation search /notable doesn't display all the fields from the identity for that particular user.

Thanks
Laks

0 Karma
1 Solution

lakshman239
Influencer

Answering my questions.

For any fields to be available and visible in the incident review screens, it needs to be in /etc/apps/SA-ThreatIntelligence/default/log_review.conf. In the above case, fields like src_user_first, src_user_last are not present and hence they weren't available. So, if we add them in the local/log_review.conf or via GUI (Configure->Incident Management->Incident Review Settings), it works.

View solution in original post

0 Karma

lakshman239
Influencer

Answering my questions.

For any fields to be available and visible in the incident review screens, it needs to be in /etc/apps/SA-ThreatIntelligence/default/log_review.conf. In the above case, fields like src_user_first, src_user_last are not present and hence they weren't available. So, if we add them in the local/log_review.conf or via GUI (Configure->Incident Management->Incident Review Settings), it works.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...