Splunk® Enterprise Security

Administer Splunk Enterprise Security

The documentation for Splunk Enterprise Security versions 8.0 and higher have been rearchitected from previous versions, causing some links to have redirect errors. For documentation on version 8.0, see Splunk Enterprise Security documentation homepage.
This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.

Enable notables for correlation searches

When you upgrade to Enterprise Security 6.4.x or higher, notable actions for some correlation searches may be disabled. If you want these correlation searches to generate notables, you must re-enable the notable actions for the correlation searches.

Use the following list to identify the correlation searches that may be disabled:

  • Access - Account Deleted - Rule
  • Access - Brute Force Access Behavior Detected - Rule
  • Access - Cleartext Password At Rest - Rule
  • Access - Default Account Usage - Rule
  • Access - Default Accounts At Rest - Rule
  • Audit - Anomalous Audit Trail Activity Detected - Rule
  • Endpoint - Should Timesync Host Not Syncing - Rule
  • Endpoint - High Number of Hosts Not Updating Malware Signatures - Rule
  • Network - Substantial Increase in an Event - Rule
  • Network - Substantial Increase in Port Activity (By Destination) - Rule
  • Asset - Asset Ownership Unspecified - Rule
  • Identity - Activity from Expired User Identity – Rule

Steps

  1. From the Enterprise Security menu, select Configure > Content > Content Management. This displays the list of knowledge objects and correlation searches.
  2. Click on the correlation search for which you want to re-enable the notables.
    This opens the correlation search editor.
  3. Scroll down to Adaptive Response Actions and click on Add New Response Action.
  4. From the list of adaptive response actions, select Notable.
  5. Scroll to Recommended Actions and select the notable actions that you want to enable for the correlation search from the list.
  6. Click Save.

In releases 6.4.0 and higher, the audit search [Audit - Notable Default Modify for Correlation Searches] generates a health check warning if default correlation searches that have been changed to generate risk notables are run as searches that generate notables. To prevent the searches from running in an infinite loop and remove the health check warning, disable the [Audit - Notable Default Modify for Correlation Searches] search on Splunk Enterprise Security UI.

Last modified on 19 January, 2022
Upgrade correlation searches in Splunk Enterprise Security   Use default risk incident rules in Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.0

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters