Skip to main content

What is "Notable Event" in Splunk Enterprise Security?

In layman terms, a notable event is an important event that needs attention. In Splunk Enterprise Security, Notable events are created automatically or manually based on specific criteria, and represent events that are considered significant, unusual or suspicious in the context of an organization's security posture. Notable events can be used to track and investigate security incidents, and to alert security analysts to potential threats in real-time. In this article, we will explore what constitutes a notable event in Splunk Enterprise Security, how they are created and managed, and their significance in improving security operations.


What is a Notable Event in Splunk Enterprise Security?

A notable event is an event that meets certain predefined criteria based on data analysis, correlation, or rules. Splunk Enterprise Security uses a variety of data sources, including logs, network traffic, threat intelligence feeds, and other contextual data, to identify notable events. Some common examples of notable events in Splunk Enterprise Security include:

  • Security Threats: A notable event could be the detection of a security threat, such as a malware infection, a phishing attack, or a brute force attack against a system.
  • Anomalous User Behavior: A notable event could be a user logging in at an unusual time or from an unusual location, or performing actions outside of their normal behavior, indicating potential unauthorized access.
  • Compliance Violations: A notable event could be the identification of a compliance violation, such as a user accessing sensitive data without proper authorization or a database containing sensitive information without proper encryption.
  • System Changes: A notable event could be the detection of a change in system configuration, settings or other aspects of the system that could be indicative of a security breach or unauthorized access.


Creating and Managing Notable Events - 

Notable events can be created manually or automatically in Splunk Enterprise Security. Automated notable events are created by using predefined rules, alerts and thresholds, while manual notable events are created based on specific security concerns or investigations. The criteria used to define a notable event can be customized based on the organization's specific security policies and requirements.

In Splunk Enterprise Security, notable events are managed using the Notable Events workspace, which provides a centralized location for monitoring and managing notable events. The Notable Events workspace allows security analysts to prioritize, investigate and respond to security incidents, and also provides tools for tracking notable events over time, correlating them with other events and generating reports for management and compliance purposes.


Significance of Notable Events in Improving Security Operations - 

Notable events are an important tool for improving security operations in organizations. By identifying important and suspicious events, they can help security analysts to prioritize and focus their efforts on the most critical issues. They can also help organizations to identify and respond to potential security threats in real-time, reducing the time required to detect and mitigate security incidents.

Notable events can also be used to improve incident response by providing a structured framework for incident management. By providing predefined workflows and automation capabilities, they can help organizations to respond to security incidents more efficiently and effectively.

Finally, notable events can also help organizations to comply with regulatory requirements and industry standards. By generating compliance reports and dashboards, they can help organizations to demonstrate their compliance with security standards and regulatory requirements, reducing the risk of fines, penalties, and reputational damage.


Example - Creating Notable Event for Brute Force Attack Detection in Splunk - 

A brute force attack is a common type of cyber attack where an attacker attempts to gain unauthorized access to a system by trying multiple username and password combinations until they find the correct one. In Splunk Enterprise Security, a brute force attack could be identified as a notable event by analyzing log data from different sources, including authentication logs, network traffic logs, and firewall logs.

Here is an example of a notable event for a brute force attack in Splunk Enterprise Security - 

Criteria for the Notable Event - 

  • More than 5 failed login attempts within 1 minute from the same source IP address
  • The source IP address is not whitelisted
  • The login attempts are targeting a privileged user account

When these conditions are met, a notable event is generated in Splunk Enterprise Security, and an alert is sent to security analysts to investigate the potential security threat. The notable event would include important details such as the source IP address, the username being targeted, and the number of failed login attempts. Custom Urgency can also be configured for the notable event. For example, assign Critical urgency to the Executive level of system/users and medium to all.

To create a Notable event, all we need to do is create AR (Adaptive Response) action for the correlation search - 



We will explore different options available for Notable events in a separate blog.

A notable event can also be created natively from any event of the search. To create a notable from Search event, click on Event Actions -> Create Notable event - 




Provide appropriate Values to the field and a Notable event will be generated - 



In summary, notable events are an important tool for improving security operations in organizations. They are used to identify important and suspicious events, prioritize security efforts, and improve incident response. By providing a structured framework for incident management and compliance reporting, they can help organizations to reduce the risk of security incidents, improve their security posture, and demonstrate their compliance with security standards and regulatory requirements. Splunk Enterprise Security's ability to automate the creation and management of notable events makes it a powerful tool for improving an organization's overall security posture. 

Labels:

Comments

Post a Comment

Popular posts from this blog

ES Framework Series - 1: Notable

Welcome to the ES Framework Series, where we explore the powerful features and functionalities of Splunk Enterprise Security (ES). In this installment, we'll delve into one of the most essential components of ES—the Notable framework. Designed to help security analysts effectively detect, investigate, and respond to threats, the Notable framework plays a crucial role in optimizing security operations. In this blog, we'll take a closer look at the notable framework, its key features, and the benefits it brings to security teams. Understanding the Notable Framework The Notable framework within Splunk ES serves as a centralized hub for managing security incidents and events. It acts as a repository for all notable events generated by ES's detection algorithms and plays a vital role in streamlining the incident response process. With the Notable framework, security analysts can efficiently investigate and prioritize security incidents, ensuring timely and effective action. Key ...
Post a Comment
Read more

Ensuring Data Integrity: How You Can Miss Events in Splunk

In the world of data analysis and monitoring, missing events in Splunk can have significant consequences. Whether you're using Splunk for real-time monitoring, security analytics, or operational intelligence, overlooking events can lead to blind spots, delayed insights, and ultimately, increased risk. In this blog , we'll explore two common scenarios where events can be missed in Splunk and discuss strategies to mitigate these risks effectively. 1. Ingestion Delay and Real-Time Monitoring: Imagine you're tasked with monitoring critical systems in real-time using Splunk. You've set up alerts to trigger whenever specific events occur within the last few minutes. However, despite having the latest=now and earliest=-10min time range in your search query, you're still missing events. What could be the reason? The Challenge: Ingestion Delay Events in Splunk undergo a process from ingestion to indexing before they become searchable. However, delays in data ingestion can o...
Post a Comment
Read more

ES Framework Series - 2: Risk-Based Alerting (RBA)

Splunk Enterprise Security (ES) is a powerful platform that helps organizations detect, investigate, and respond to security threats. It provides a comprehensive set of security analytics, threat intelligence, and automated response capabilities. One of the key features of Splunk ES is its Risk-Based Alerting Framework, which enhances the effectiveness of security operations by prioritizing and alerting on the most critical risks. In this blog post, we will explore the Risk-Based Alerting Framework of Splunk ES and understand how it can improve your organization's security posture. The Need for Risk-Based Alerting: Traditional security monitoring approaches often generate a high volume of alerts, overwhelming security teams and making it difficult to focus on critical threats. Not all security incidents carry the same level of risk or require immediate attention. The Risk-Based Alerting Framework addresses this challenge by providing a systematic approach to assess the risk associa...
Post a Comment
Read more