Splunk Enterprise Security

Configuring Notable event

ajayrejin
Explorer

I am trying to create a notable event I am writing a query (index=****** EventCode=4771) in search App and then clicking on SaveAs and then click on Alert. Then a popup opens for alert configuration. In that i have trigger Actions where there is option of Notable( Creates notable events). This creates a notable event . Is this the correct way of creating?

I see notables events created in Enterprise Security, however there is lot of events triggered (close to 1000 events) Each single events are generated, but not the aggregated one. Is there a way i can aggregate that in ES? .

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls go through this and create correlation searches and add throttling to limit the number of alerts you see. Also, a good practice would be to use index= your_specific_index addition to your search above

https://docs.splunk.com/Documentation/ES/5.2.2/Tutorials/CorrelationSearch

0 Karma

ajayrejin
Explorer

I dont see that option of create correlation search under the configure->Content_>Content Mangagmeent->Create New content. I dont have admin access, its power user.

Let me tell how i created a notable event first. From the Search&Reporting app, wrote a query , then clicked on save as->Alert->filled in all the conditions->under trigger actions selected notable(creates notable events)

What is happening now is that configured alert is firing individual notable events and not aggregated one(like 10 failed logins in 1 min, then fire 1 notable event, that is not the case, all the 10 failed events are firing).
I had already given aggregation when i created that alert. Is there any way i can put an aggregation on notable event itself.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

I assume you are using Splunk Enterprise Security (premium product). If so, you would need to navigate to 'Enterprise Security' App and then you can navigate to Configure->Content Mgmt etc...

When working in Splunk ES, normally, we don't use 'Search and reporting' app, as the context is different.

If you are not having Splunk ES, what you are trying to do is the normal alert. Pls check again and share the splunk version and Splunk ES version. Also, go through above link.

0 Karma

ajayrejin
Explorer

We are using Splunk Enterprise security, Splunk version is 7.1.3 and ES version is 5.2.2.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

ok, good. Did you follow the link https://docs.splunk.com/Documentation/ES/5.2.2/Tutorials/CorrelationSearch to create and test your search? If the issue resolved now?

0 Karma

ajayrejin
Explorer

I did go through the document, but i dont see a option of creating a correlation search as mentioned in the document.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Are you logging in as 'admin' or any other user? if its not admin, you need to make sure your role/user has required capabilities.

0 Karma

alemarzu
Motivator

Hello there @ajayrejin

Have you read this? https://docs.splunk.com/Documentation/ES/5.2.1/Admin/Createnotablesmanually

Kind regards.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...