Splunk Enterprise Security

Splunk ES - How to ddd a Status to Incident Review Dashboard?

sswansonchtr
Path Finder

Under the 'Incident Review' dashboard, I want to add a Status type of 'False Positive' so I can easily find these and use them to help me tune the correlations etc. I found that I can change this lookup file: /splunk/app/splunk/etc/apps/SA-ThreatIntelligence/lookups/reviewstatuses.csv and it will show up correctly in the top fields for searching/filtering. This goes away on a refresh/reload of the service though. Also, editing this file, does not show the new Status type as an option when 'editing' events in the bottom panel.

Labels (1)
0 Karma
1 Solution

LukeMurphey
Champion

Use the notable event statuses editor to add a review status. That page will also help you define who and how statuses are allowed to be transitioned.

View solution in original post

LukeMurphey
Champion

Use the notable event statuses editor to add a review status. That page will also help you define who and how statuses are allowed to be transitioned.

sswansonchtr
Path Finder

Thanks for the info. I tried this and it will stay after I refresh/reload splunk but I still don't get an option to label the event as that new status. It only shows up in the filtering options. Not when I select to edit the event. Not sure if it only applied to new notables so I will wait until I get one.

0 Karma

rsteffes
Engager

In case anyone else is unable to see their custom event status in the "Edit Events" menu, you have to edit the existing statuses in the status editor and give user groups authorization to transition the status to your new custom status.

n00b
Explorer

2.5 years later, still useful. This is what I was missing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...