Known issues for Splunk Enterprise Security

Following are the known issues for this version of Splunk Enterprise Security:

Date filed	Issue number	Description
2022-08-12	SOLNESS-32134	Correlation search for ES Threat Activity Detected is incorrect.
2021-09-01	SOLNESS-28019	"src" or "dest" fields of Threat Activity events showing as "unknown" even though "threat_match_fields" is "src" or "dest" Workaround: # Navigate to the threat intelligence management page and click on the threat matching tab Click on, for example, "src" to edit that threat match configuration Scroll down on the modal and click the pencil for the first data model dataset Click on the "+ Add aggregate" and add "<datamodel>.src as src" to add the source field as an aggregate. Click Save. Repeat for other datasets as needed Repeat all steps for other threatmatch configurations as needed
2021-08-31	SOLNESS-28002	. ES Traffic centre dashboard is still using the deprecated saved search.
2021-05-12	SOLNESS-26883	Annotations configured on correlation search editor do not display on the Incident Review page.
2021-04-29	SOLNESS-26712	Incident review page loads slowly after an upgrade to Splunk Enterprise Security version 6.4 or higher. Workaround: Add a reasonable time period to the get_active_correlations macro. For example, earliest = -90d. Otherwise, correlation searches that do not create a notable within that time frame cannot be selected as an option in the filters when the Incident Review page loads. The macro should look something like this after editing: tstats values(source) as source where {{get_notable_index}} earliest = -90d | mvexpand source | lookup correlationsearches_lookup _key as source OUTPUTNEW rule_name
2021-03-03	SOLNESS-25956	Next Steps for adaptive response actions do not parse correctly in the Incident Review dashboard. Workaround: Enter each of the adaptive response actions on separate lines in the Next Steps field of the Correlation Search editor.