Manage findings included in investigations in Splunk Enterprise Security

You can add or remove findings and finding groups from an investigation to streamline the review process and focus on the root cause.

Add findings to an investigation in Splunk Enterprise Security

Add a finding or finding group to an investigation so that you can review all the information associated with the findings in context and determine the next course of action. You can also assign an investigation to an analyst and collaborate with other analysts to review investigations.

You can add a finding to an investigation using any of the following methods:

Select Add to investigation on the Mission Control page

Follow these steps to add a finding to an investigation in Splunk Enterprise Security:

  1. In Splunk Enterprise Security, go to the Mission Control page.
  2. From the Analyst queue, select the finding or finding group that you want to convert to an investigation.
  3. Select Add to investigation to add the selected findings or finding groups to an investigation.
    Note: Findings that have already been added to an investigation have the option to View investigation, where you can either see a list of investigations that the finding is included in, or if it's only included in one, navigate directly to the investigation.
  4. Determine whether you want to create a new investigation or add the finding or finding group to an existing investigation.
  5. (conditional) if you want to create a new investigation, follow the steps to Create a new investigation
  6. (conditional)if you want to add the finding or finding group to an existing investigation, follow the steps to Add findings to an existing investigation.

Select Add to investigation from the Actions drop-down menu

Follow these steps to add a finding to an investigation in Splunk Enterprise Security:

  1. In Splunk Enterprise Security, go to the Mission Control page.
  2. From the analyst queue, select the finding or finding group that you want to convert to an investigation.
  3. Go to the three dots in the Actions drop-down menu next to the finding or finding group that you want to add to the investigation.
  4. Select Add to investigation to add the selected findings or finding groups to an investigation.
    Note: Findings that have already been added to an investigation have the option to View investigation, where you can either see a list of investigations that the finding is included in, or if it's only included in one, navigate directly to the investigation.
  5. Determine whether you want to create a new investigation or add the finding or finding group to an existing investigation.
  6. (Conditional) If you want to create a new investigation, follow the steps to Create a new investigation
  7. (Conditional) If you want to add the finding or finding group to an existing investigation, follow the steps to Add findings to an existing investigation.

Create a new investigation

Follow these steps to add findings or finding groups to a new investigation:

Prerequisite: Access the Add to investigation dialog box in Splunk Enterprise Security.

  1. In the Add to investigation dialog box, select Create new investigation.
  2. In the Name field, enter a name for the investigation.
  3. (Conditional) Select the check box to automatically update the values of the owner, status, urgency, sensitivity, and disposition of findings with the values of the investigation.
  4. Assign an owner to the investigation by using the Owner drop-down menu. For example, Splunk administrator or Lily White.
  5. Assign a status to the investigation by using the Status drop-down menu. For example, New or Unassigned.
  6. Assign an urgency to the investigation by using the Urgency drop-down menu. For example, Critical or High.
  7. Assign a sensitivity to the investigation by using the Sensitivity drop-down menu. For example, White, Green, Amber, Red, or Unassigned.
  8. Assign a disposition to the investigation by using the Disposition drop-down menu. For example, True positive -Suspicious activity
  9. In the Description field, enter a description for the investigation.
  10. Select Save.

Add findings to an existing investigation

Follow these steps to add findings and finding groups to an existing investigation:

Prerequisite: Access the Add to investigation dialog box in Splunk Enterprise Security.

  1. In the Add to investigation dialog box, select Add to existing investigation.
  2. Select an investigation from the Investigation drop-down menu or select an investigation from the list of recent investigations.
  3. (Conditional) Select the check box to automatically update the values of the owner, status, urgency, sensitivity, and disposition of findings with the values of the investigation.
  4. Select Save.

Aggregate findings or finding groups into an investigation

Aggregate findings or finding groups into an existing investigation or a new investigation automatically in Splunk Enterprise Security to avoid alert overload. You can define an aggregation rule that matches the criteria within a single team-based queue or across team-based queues to efficiently move findings into investigations instead of manually adding findings or finding groups to investigations.

Automation rules can run a playbook when an aggregation rule starts an investigation or adds a finding to one. Select the event that might trigger the automation, the relevant aggregation rule, and the playbook to run.

When aggregation is turned on, two triggers are available for these events:

  • Finding added to investigation: This trigger runs when the aggregation rule adds a finding or finding group to an investigation.

  • Investigation started: This trigger runs when the aggregation rule starts a new investigation for a finding or finding group.

For example, you can select the Risk_object (Entity) aggregation rule and run a playbook each time it adds a finding to an investigation. You can use a separate automation rule to run a different playbook when that rule starts an investigation.

When aggregation is turned off, Finding created is available. Existing automation rules transition to the Finding created when you upgrade to Enterprise Security version 8.8 and higher. If you later turn off aggregation, rules configured with the Finding added to investigation trigger or the Investigation started trigger also transition to Finding created.

Note: You can include 1000 findings to each investigation.

Aggregate findings or finding groups into investigations

Follow these steps to aggregate findings or finding groups into an investigation automatically based on specific rules:

  1. In Splunk Enterprise Security, go to Configure.
  2. Go to Findings and investigations and select Investigation aggregation.
  3. Turn on Investigation Aggregation, which is turned off by default.
    Note: When you turn on the aggregation feature, findings or finding groups are matched to investigations going forward. However, findings or finding groups created prior to turning on this option are not automatically matched or added to investigations. Additionally,

    findings that do not match a rule automatically create an investigation.

    Note: A Splunk administrator can search for changes to this page using the mc_history index for review.
  4. Select Proceed to confirm that you want to turn on Investigation Aggregation.
  5. Select whether you want to match findings to investigations based on a single team-based queue or across team-based queues.

    The following are the default rules which are available for use to match findings or finding groups to investigations.

    Rule name Description
    $risk_object$ (Entity) Group findings together that involve the same entity.
    $threat_object$ (Threat Object) Group findings together that share the same threat object.
    $email.headers.from$ (Reported Phishing Sender) Group findings together that involve the same sender.
    Note: Aggregation rules are stack ranked. Aggregation evaluates the rules from top to bottom, in the order shown. If a finding or finding group does not match a rule, the engine moves to the next one. If it matches a rule but no investigation meets the rule’s match settings, the engine moves to the next rule when the configured action is Evaluate the next rule.
  6. Select +Rule to create new rules to match findings or finding groups to investigations. You can use the AI-based Investigation Aggregation Assistant to create any new rules.
    Note:

    After a finding or finding group matches a rule, investigation aggregation uses that rule's Match settings to determine which matching investigation it is added to. By default, aggregation adds the item to an open investigation, if that investigation was last updated less than 7 days ago. The time range can be configured at any point, with support for days, weeks and minutes. If no investigation meets the condition, the default action is to evaluate the next rule. You can optionally add an else if condition for investigations in an end state. When an investigation meets that condition, the item gets added to the investigation without reopening the investigation. If multiple eligible investigations match equally well, the engine adds the item to the one with the most recent last updated time.

  7. Enter values for a name and description.

  8. Set the conditions to indicate what values should be matched for a field to aggregate findings and finding groups. For example, if you want to aggregate findings that involve Crowdstrike, you can select the following: for Field, enter Vendor; for Comparison, enter is one of, for Value, enter Crowdstrike.

    Following are some examples of comparison values that you can use:
    Comparison Description
    Any in investigation Matches an investigation when at least one existing value for the selected field matches a value on the incoming finding or finding group. Other values may be present in the investigation.
    All in investigation Matches an investigation only when every existing value for the selected field matches the incoming value.
    Note: The comparison values any in investigation and all in investigation can be applied to any field value in a rule. For example, if the incoming finding has source = app01, an investigation with sources app01 and app02 matches Any in investigation because app01 is present. It does not match All in investigation because app02 is also present. An investigation whose only source is app01 matches both.

  9. Select Save.

  10. Turn on the rule to activate it for matching findings and finding groups.

  11. Sort the rules to change the sequence in which the rules are displayed based on your preference.

Remove findings from an investigation

Follow these steps to delete findings and finding groups from an existing investigation:

  1. In Splunk Enterprise Security, go to the Mission Control page.
  2. From the analyst queue, go to the finding or finding group that you want to remove from an investigation.
  3. Select the finding or finding group to open the finding or finding group in the finding details panel.
  4. Select the View details drop-down menu.
  5. Under Overview, select the three dots next to the finding name.
  6. Select Remove finding from investigation to delete the finding from the investigation.

Sync changes with included findings

Sync changes with included findings

Apply changes made in an investigation or finding group to all of its included findings. For example, if you reassign the owner of an investigation, you might also want that same owner assigned to all findings within it. Syncing changes helps streamline the triage process.
When you opt to sync changes, updates to specific fields automatically apply to all included findings. These fields are:

  • Owner

  • Status

  • Urgency

  • Sensitivity

  • Disposition

If a finding is included in multiple investigations or finding groups, it retains the most recent values applied to these fields. For example, if you assign a finding to yourself, and another analyst edits that same finding from a different investigation shortly after, then the finding reflects the most recent changes.
Note: New findings manually added to a finding group or investigation do not inherit the field values already set for the group.
  1. In Splunk Enterprise Security, select Mission Control to find the analyst queue.
  2. Select a finding group or investigation from the analyst queue to open the side panel.
  3. Select the check box for Apply changes to included findings.
  4. Change the values for Owner, Status, Urgency, Sensitivity, or Disposition using the drop-down menus.
  5. (Optional) To end an investigation or finding group, change the Status to one your organization designates as an end status. For example, Resolved or Closed.
    1. Select Apply in the resulting End investigation dialog box to end all included findings.