Search for findings in Splunk Enterprise Security
You can search and review hidden findings in the analyst queue using the event_id or finding attributes even after they are moved into an investigation or finding group.
Findings associated with active investigations can be hidden to reduce the alert volume and prevent duplicate findings from the displaying in the Analyst Queue by activating the Hide findings option. However, this can prevent you from reviewing the investigation context or access cross-platform links to findings, making it impossible to confirm whether a finding exists, is under an investigation, or has been resolved.
In Splunk Enterprise Security version 8.8 and higher, you can search for findings after they are moved into an investigation or finding group using the event_id of a finding or finding attributes and identify the following:
-
whether the finding is part of an active investigation.
-
access the investigation context when you retrieve findings by
event_id -
Filter, sort, or view all the fields for findings in the Analyst Queue.
Search for findings using the event ID
Follow these steps to search for findings using the event ID:
Prerequisite:The finding is part of an active investigation or finding group.
- In Splunk Enterprise Security, go to the Analyst queue.
-
In the search filter, enter the finding ID, event ID.
-
Review the associated parent investigation or finding group for the finding in the search results.
Search for findings using finding attributes
Follow these steps to search for findings using the event ID:
Prerequisite: The hidden finding contains a searchable attribute such as user, host, risk object, source, destination, or a custom field.
field_name=value in the search bar.
-
In Splunk Enterprise Security, go to the Analyst queue.
-
In the search filter, enter the finding attribute such as user, host, risk object, source, destination, or a custom field.
-
Review the associated parent investigation or finding group for the finding in the search results.