Create investigation types in Splunk Enterprise Security

Create investigation types to associate investigations with custom fields and response plans such as phishing, ransomware, Crowdstrike, and so on.

Follow these steps to create investigation types and associate them with response plans or custom fields in Splunk Enterprise Security:

1. In Splunk Enterprise Security, go to the Configure tab.
2. Select Findings and investigations and then select Investigation types.
3. In the Investigation types page, select +Investigation type to create a new investigation type. You can also select a default investigation type from the available list. For example, you can create or select an incident type with the name "Phishing".
4. Enter a name for the investigation type. For example, ransomware

   You can't rename investigation types after you create them. You must create another investigation type instead.

5. Enter a description for the investigation type.
6. Select Next.
7. Select Save.
8. (Optional)Edit an investigation type that you've already created by selecting the investigation type from the Investigation types table. You can assign response plans and custom fields to the investigation type, or remove response plans and custom fields from it. You can also create new response plans and new custom fields based on your requirements.

See also

For more information on using macros and custom fields for investigations, see the product documentation:

• Add custom fields to add to investigation types in Splunk Enterprise Security
• Configure investigation macros to assign investigation types in Splunk Enterprise Security