Enterprise Security notable events, how to calculate Alert acknowledged / Alert closed Report?? Is there any report in Splunk or please let me know the query to generate report??
Hi All,
Anyone know how to pull the above report from splunk??
Anyone know this, need your assistance.
Have you looked at the Audit->Incident Review Audit dashboard? This shows reviewed/closed ones.
You can look at the underlying searches and update as needed.
You can also look at http://dev.splunk.com/view/enterprise-security/SP-CAAAFBA to view diff macros and create searches to match your need
e.g |incident_review
| rename status_label AS status |