Using notable events in search

Was this page helpful?

On this page

When a notable event is created, Splunk Enterprise Security indexes the event on disk and stores it in index=notable. Additional enrichment data is added to notable events at search time from various lookups and KV store collections.

To search for notable events, use the notable macro in your search rather than searching the notable index directly. The notable macro fills in default values and extracts the state of the event from the incident_review KV store collection. Some fields are consistent for all notable events, and each notable event returns different additional fields depending on the syntax of the correlation search. See Customize notable event settings in Splunk Enterprise Security.

Notable event field type	Description	Examples
Event fields	Fields that all events have when indexed.	`_time` `host` `source` `sourcetype`
Search-time-enriched fields	Fields added at search time by various correlation mechanisms.	`event_id` `xref_id` `risk_score`
Stash event fields	Each notable event is a stash event created by an adaptive response action. The notable event includes fields specific to this creation method.	`orig_action_name` `orig_sid` `orig_rid`
Incident review activity fields	Fields related to the notable event on Incident Review. See Incident review activity fields.	`status` `owner`
Correlation search fields	Fields related to the correlation search that returned the notable event.	`rule_name` `severity`

Notable event fields enriched at search time

Some fields for a notable event are indexed with the notable, but many are enriched at search time.

Type	Field	Description
Unique identifier	`event_id`	Assigned at search time by the `notable` macro. Uniquely identifies a notable event. Used to create and update the status and user assignment of a notable event.
External reference	`xref_name`	Exists only when an external reference for a notable event is created. Identifies the type of external reference.
External reference	`xref_id`	Exists only when an external reference for a notable event is created. Identifies the notable event with a unique ID.
Asset correlation	`src_is_expected` `src_should_timesync` `dest_should_update` `dest_requires_av`	Fields from the asset lookup, prepended by the asset field. See Configure asset and identity correlation in Splunk Enterprise Security.
Identity correlation	`user_bunit`	Fields from the identity lookup, prepended by the identity field. See Configure asset and identity correlation in Splunk Enterprise Security.
Risk correlation	`risk_score`	Calculated risk score for the affected asset, identity, or other risk object type in the notable event.

Notable event stash fields

These stash fields help you identify notable events, and are indexed with the notable event.

Field	Description
`orig_event_id`	Identifies the contributing event for a notable event, when a notable event is created from one event. Not all notable events include an orig_event_id. For example, searches that generate notable events based on an aggregate set of events do not include an orig_event_id.
`orig_sid`	Identifies the correlation search that created the notable event, by search ID.
`orig_rid`	Identifies the result position of the notable event within the correlation search results that created the notable event, for correlation searches that generate notable events on a per-result basis.
`orig_action_name`	Identifies the name of the adaptive response action that created the stash event. For notable events, this is always `notable`.
`info_min_time` `info_max_time`	Define the time period of the correlation search that produced the notable event. Earliest time and latest time, respectively.

Incident review activity fields

You can also search analyst activity on notable events on Incident Review. Search notable events that have been reviewed by an analyst with the incident_review macro.

A search for | incident_review shows incident review activity using following fields.

Field	Description
`_time`	Local time of the incident review event.
`comment`	The reviewer's comment on the notable event at the time of the incident review event.
`owner`	The assigned owner of the notable event at the time of the incident review event. This is the account name. To convert to a full name, use the `notable_owners` macro.
`reviewer`	The user who performed the incident review event.
`rule_id`	The unique event identifier.
`rule_name`	The correlation search that generated the notable event.
`status`	The numeric status code of the notable event at the time of the incident review event.
`status_default`	Whether the notable event is in its default status at the time of the incident review event. Boolean.
`status_description`	The long form description of the notable event status at the time of the incident review event.
`status_end`	Whether the notable event is in an end status at the time of the incident review event. Boolean.
`status_group`	Status group of the event. Open, New, or Closed.
`status_label`	The short form description of the notable event status at the time of the incident review event.
`time`	GMT time of the incident review event.
`urgency`	The urgency of the notable event at the time of the incident review event.

You can use these fields in the search pipeline to evaluate and report on notable event incident review activity.

Useful Notable Event macros

You can search notable events using the macros included with Splunk Enterprise Security.

Macro	Usage details
`notable`	Return the notable events in the notable index.
`incident_review`	Return incident review activity for the notable events.
`notable_by_id(id)`	Retrieve the notable event associated with an `event_id`.
`notable_xrefs`	Retrieve the list of notable external reference ID numbers in your environment. Use the macro in search with a leading
`notable_xrefs_by_event_id(id)`	Retrieve the notable event external references associated with an `event_id`.
`notable_owners`	Looks up the name of a person who owns a notable event using the owner field.