Findings and finding groups in Splunk Enterprise Security

You can add findings and finding groups to an investigation to group relevant alerts together for triage and leverage additional Splunk Enterprise Security functionality to investigate potential security threats. You can also add multiple finding groups to an investigation.

Investigations are cases that are displayed in the analyst queue of the Mission Control page in Splunk Enterprise Security. You can configure Splunk Enterprise Security to automatically create investigations using Splunk SOAR playbooks and response actions.

Investigations are a collaborative process for security personnel such as analysts, SOC managers, automation engineers, security architects and so on to identify, collect, and examine findings or finding groups in Splunk Enterprise Security to detect and triage security threats. All investigations display their contributing events, findings, and finding groups as parts of the whole investigation in the analyst queue of the Mission Control page in Splunk Enterprise Security. Investigations also contain response actions to handle potential threats, including drill-down searches.

Findings are aggregated into finding groups when a finding-based detection is configured to meet a specific criterion. The following table provides some examples of how findings might be grouped together:

Finding group type Criteria
Entity When findings are created from the same entity.
Threat object When findings are grouped by a common threat object.
Cumulative entity risk When findings from an entity exceed a risk threshold during a certain time range.
Kill Chain Kill chain phases exceed a threshold on an entity over a time range.
MITRE ATT&CK When findings exceed a MITRE ATT&CK threshold for techniques and tactics for an entity over time.
Similar findings When findings are related to each other and a custom risk rule groups the findings together.

When a finding is added to an investigation, data associated with the finding such as team queue membership, status, ownership, and so on, is associated with the parent investigation.In Splunk Enterprise Security version 8.8 and higher, each finding is associated with only one parent investigation and cannot be added to multiple investigations. A finding that is part of an investigation can be moved to another pre-existing investigation, instead of being added to a new investigation. Thus, multiple investigations are not created to investigate the same finding.

Note: When using SOAR and REST APIs, you can use add_only=true to suppress the removal of the finding from the prior investigation.
Once you create an investigation, you cannot delete it in Splunk Enterprise Security. Investigations can be archived according to their queue-configured retention policy once they are closed. Additionally, archived findings and investigations are hidden from the queue.

If a finding in the finding group is already part of an investigation, the entire finding group is also a part of the same investigation. This occurs because the reference to the finding, which continues to exist as a finding, is added to the investigation.

Note: Do not select a large number of events or findings in the Analyst Queue to perform bulk edits such as changing statuses, changing urgencies, adding to investigations, or assigning owners. Mass updating thousands of findings simultaneously puts a heavy strain on the search head memory and performance. You can only process a maximum of 10,000 findings during a bulk update. Otherwise, the browser session or the underlying rest handler endpoint can time out.
You can add a maximum of 100 findings to an investigation. However, Splunk Enterprise Security can add any number of findings or intermediate findings to a finding group.

A contributing event is an event that contributes to the creation of a finding in Splunk Enterprise Security. If a finding group has several contributing events, the consolidated raw data from those contributing events can significantly increase the size of the finding group. To avoid this, only a maximum of 50 events can be aggregated even though the number of findings that can be added to an investigation is 100.

An investigation can be created if an analyst opts to take specific actions on a single finding in the analyst queue of the Mission Control page or the Overview panel. An investigation is either triaged from findings or created by SOAR automation. A single finding can be an investigation.

An event-based detection can generate single findings whereas a finding-based detection generates finding groups. Both findings and finding groups can be triaged into an investigation.

You must create an investigation manually to view the risk event timeline visualization or topology visualization. You can only run automation rules or response plans from an investigation.