This documentation does not apply to the most recent version of Splunk® Enterprise Security.
For documentation on the most recent version, go to the latest release.
Sort notables by disposition
Ram now sorts the notables by disposition in the Incident Review page so that he can drill down on the risk notables that are tagged as True Positive - Suspicious Activity and ignore the false positives as shown in the following image.
- From the Enterprise Security menu, Ram selects the Incident Review page that provides a list of notable events for the security domains.
- Ram clicks Disposition in the table to sort the notables tagged as True Positive - Suspicious Activity.
The table of notable events in the Incident Review page also lists the risk events associated with the notable.
Now Ram can focus on investigating risk notables that are grouped together as True Positive - Suspicious Activity.
Last modified on 19 January, 2022
This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1, 7.0.2, 7.1.0, 7.1.1, 7.2.0
Download manual
Feedback submitted, thanks!