Known Issues for Splunk Enterprise Security

The following are issues and workarounds for this version of Splunk Enterprise Security.

Date filed	Issue number	Description
2020-11-30	SOLNESS-24852	UI error "Search does not exist" when selecting to view/edit correlation searches Workaround: Edit/view impacted correlation searches under 'All configuration'.
2020-07-30	SOLNESS-23521	Identity Management: Only transforms from specific apps are being displayed on "New Asset" modal
2020-07-14	SOLNESS-23451	Notable Event Framework: Searches converted from XS to MLTK did not have their tokens updated Workaround: Update the rule_description for the following searches. [Network - Unusual Volume of Network Activity - Rule] action.notable.param.rule_description = An unusual volume of network activity was detected. $src_count$ unique sources have generated network traffic in the past 15 minutes and $total_count$ network events have been observed in the same time period. [Network - Substantial Increase in Port Activity (By Destination) - Rule] action.notable.param.rule_description = A statistically significant increase in the volume of activity on port $dest_port$ was noted. Today's value is $dest_port_traffic_count$. [Network - Substantial Increase in an Event - Rule] action.notable.param.rule_description = A statistically significant increase in the volume of $signature$ events was noted. Today's value is $ids_attacks$.
2020-05-13	SOLNESS-22828	Notable event status or owner sometimes are wrong because of size of incident_review collection Workaround: Set max_rows_per_query in limits.conf to a size greater than the size of the incident_review_lookup collection and restart Splunk. To check this: index=_introspection host+<ES SH> sourcetype=kvstore "data.ns"="SA-ThreatIntelligence.incident_review" | stats max(data.count) AS count And if this count is bigger than the max_rows_per_query limit in limits.conf, increase it on the search head(s): limits.conf: [kvstore] max_rows_per_query = <something bigger than the count above> and restart Splunk afterwards.
2020-05-11	SOLNESS-22809	CustomSearchBuilder: Retention component for kvstore backed search-driven-lookup not working
2020-04-09	SOLNESS-22356	Suppressing notable event gives a javascript error when the title contains special characters such as Workaround: Update the Correlation Search to remove a list of special characters that have special meaning in regex, so the title of the Notable Event will not have these characters: [\^$.|?*+()
2020-02-13	SOLNESS-21783	Incident Review does not load when read permissions on pertinent lookups are limited to select roles
2019-03-15	SOLNESS-18377, SPL-167855	Workbench: custom visualizations don't work in workbench