Splunk Enterprise Security

Tracking change history on Incidents in ES App

coolwater77
Explorer

I am trying to understand if I can track changes related to the incidents managed by the ES App.Below are my requirements

For Example, lets say the correlation search generates an incident in the incident review dashboard with the title of the incident as " Root login Failed" and automatically assigns the ticket to a security analyst automatically as configured on the correlation search rule. As part of the investigation if the analyst thinks this is not a "Root login Failed" incident but a " excessive failed login" can he manually change the title of the incident that was automatically generated with a different title. And also how can someone track these changes to monitor who and what has changed?

Also, similar can it also be done on the Splunk core App as well.

0 Karma

LukeMurphey
Champion

All of the changes to incidents are retained in the Incident Review lookup file as well as in audit logs. To view the history, find the event on the Incident Review page, click "view details" and then click "View all review activity for this Notable Event".

That said, I don't believe that Incident Review allows changing of the title yet (perhaps I am misunderstanding).

coolwater77
Explorer

I think you understood it right . I am just trying to figure out if one can change the title manually later and if so how to track those modifications

0 Karma

LukeMurphey
Champion

@coolwater77: BTW: adding the ability to change the title of incidents sounds like a good idea. Feel free to submit an enhancement request; I think this could be added relatively easily in a future release.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...