Splunk Enterprise Security

Is it possible for an alert outside of the Splunk ES app to create and push notable events to Splunk ES?

hettervik
Builder

Hi.

We've just installed Splunk ES and want to utilize the notable event functions. I know there is some correlation searches out-of-the-box, but we also have quite a few alerts already sat up in an existing app. As of now the app with the existing alerts lies on the same search head as Splunk ES. If we try to edit one of the "alert actions" for one of the alerts in the app we indeed get an option for named "Notable", which seems to be the same notable event correlation search action that Splunk ES uses, but there is no further options available. That is, we can't set either the severity, related assets, or related users for the notable event, nothing.

Does anyone know if it's possible to create a notable event from an alert outside of the Splunk ES app, and if so, how?

1 Solution

jawaharas
Motivator

Good question!

Yes, you can create notable events outside of Splunk ES app. But as you said, there is no option to edit severity and other usual fields of a notable alert. By default, a 'low' severity notable alert will be created.

The best approach is to use 'Correlation Search' in ESS to create notable event from an alert.

View solution in original post

jawaharas
Motivator

Good question!

Yes, you can create notable events outside of Splunk ES app. But as you said, there is no option to edit severity and other usual fields of a notable alert. By default, a 'low' severity notable alert will be created.

The best approach is to use 'Correlation Search' in ESS to create notable event from an alert.

jawaharas
Motivator

Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

hettervik
Builder

Thanks! Do you know if it's possible to edit the severity and other fields of the notable events in the stanza for the alert in savedsearches.conf? I guess it's no problem to move all my existing alerts into the Splunk ES app, but it is a bit of a hassle.

0 Karma

jawaharas
Motivator

I have tried add below parameter to 'savedsearches.conf'. But 'severity' of notable alert is still 'low'.

action.notable.param.severity = high

Better to raise a case with Splunk support team.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...