I'm wanting to add the short ID that one can generate for a notable in IR.  To the columns in Incident Review for our SOC to use.  However, I can't find the proper attribute name for this and it's not in the notable index, or in notable_xref_lookup or es_notable_events lookup.  Hoping someone can tell me what the correct "Short ID" attribute name is. Also hoping someone can tell me how to force ES to create a Short ID for EVERY notable.  Thanks in Advance!   ... View more

I have a really simple query that I'd like to join with Enterprise Security's Identity data. In this case, simply grab the user from a Palo Alto system log, cross reference the user with ES Identity lookup and grab the priority field for that user.  Simple right?? Here is the SPL I've tried: index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*") | join type=left user [ |inputlookup es_identity_lookup | search identity=user | fields priority ] | table _time user priority   But nothing populates the priority field.  Also tried:    index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*") | lookup es_identity_lookup identity AS user OUTPUT priority | table _time user priority But this doesn't even run. Throws an error.    Any help here would be most appreciated! Thanks in advance.        ... View more

I have a really simple query that I'd like to join with Enterprise Security's Identity inputlookup and grab a field from there.  Here is the simple SPL: index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*") | table _time user Trying to use a join to grab the data: index=pan sourcetype="pan:system" log_subtype=globalprotect description IN ("GlobalProtect gateway client configuration generated*") | join type=left overwrite=true user [ |inputlookup my_identity_lookup | search identity=user | fields priority ] | table _time user priority   But the priority field returns blank. Would appreciate any help fixing this!  Thanks in advance! ... View more