Splunk Enterprise Security

Null value for urgency in incident_review lookup

evelenke
Contributor

Hi Splunkers,

when we save\close notable events without changing the Urgency we get no any value (null) for urgency in incident_review_lookup.
In ES Incident Review view the Urgency is shown and just has initial value (as expected).
Is it possible to get the default value for urgency in lookup in case we want to leave urgency as is?

alt text alt text

0 Karma

nswondem
Path Finder

One of my customers had this situation before and it turned out that the severity was being assigned an unknown value in the correlation search. Take a look at the ES documentation for determining urgency.

https://docs.splunk.com/Documentation/ES/5.3.1/User/Howurgencyisassigned

In the customer's case, the assigned priority was being overwritten in the correlation search. It was being set to a value that was not in the blue or gold sections of the urgency table (see link).

So for example ES expects the Assigned Priority to be Unknown, Low, Medium, High, or Critical. If your correlation search mistakenly sets a field called priority to Informational then ES cannot correctly calculate the urgency. You will get a NULL value.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...