Configure the settings for the analyst queue in Splunk Enterprise Security

Configure settings to modify analyst capabilities and permissions to customize the display of findings and investigations in the Analyst queue of the Mission Control page in Splunk Enterprise Security. You can override and replace the calculated urgency of a finding or an investigation. You can also set up a time range to ensure specific findings or investigations are displayed in the Analyst queue. Additionally, you can turn on auto-refresh to update the list of findings and investigations automatically in the Analyst queue.

Override and replace the calculated urgency of a finding or investigation

Follow these steps to configure whether analysts can override the calculated urgency of a finding or an investigation:

1. In the Splunk Enterprise Security app, select Configure.
2. Select Findings and investigations and then select Analyst queue settings in the left panel.
3. In the Analyst queue settings dialog, turn off the button to override and replace the calculated urgency of findings and investigations. When this button is turned on the urgency level is displayed for findings and investigations in the Analyst queue.

   Analysts are allowed to override urgency by default.

Add a default time range for findings and investigations

Add a default time range to restrict the display of findings and investigations in the Analyst queue occurring within that time window. Adding a default time range helps to keep the number of findings and investigations in the Analyst queue to a manageable level.

Follow these steps to add a default time range for displaying findings and investigations:

1. In the Splunk Enterprise Security app, select Configure.
2. Select Findings and investigations and then select Analyst queue settings in the left panel.
3. In the Analyst queue settings dialog, go to Analyst queue: Default time range.
4. Enter an Earliest time and Latest time to specify the time window.

Turn on auto-refresh to update findings and investigations

Configure a specific frequency to refresh findings and investigations on the Mission Control page so that they get automatically updated and new findings can be addressed in a timely manner.

Follow these steps to configure a specific frequency to auto-refresh findings and investigations:

1. In the Splunk Enterprise Security app, select Configure.
2. Select Findings and investigations and then select Analyst queue settings in the left panel.
3. In the Analyst queue settings dialog, go to Analyst queue: Auto-refresh.
4. Turn on the Auto refresh button to display the auto refresh option on the Mission Control page.
5. Select the default state whether you want auto-refresh to be tuned off by default or not.
6. Select a default time to auto-refresh findings from the Time interval drop down. You can select any of the following options: 30 seconds, 1 minute, 2 minutes, or 5 minutes.

After auto-refresh is configured in the Analyst queue settings, you still have the option to turn it on or off when you select Auto refresh on or Auto refresh off from the Mission Control page.

See also

For more information on calculating urgency and adding notes in Splunk Enterprise Security, see the product documentation:

• Configure the urgency for findings in Splunk Enterprise Security
• Create and share notes on an investigation