get_notable_history_for_endpoint.json

{
  "creation_date": "2017-03-15",
  "data_metadata": {
    "data_source": [
      "Notable Events"
    ],
    "providing_technologies": [
      "Splunk Enterprise Security"
    ]
  },
  "description": "This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation.",
  "entities": [
    "dest"
  ],
  "how_to_implement": "If you are using Enterprise Security you are likely already creating notable events with your correlation rules. No additional configuration is necessary.",
  "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7",
  "investigate": {
    "splunk": {
      "fields_required": [
        "dest"
      ],
      "schedule": {
        "cron_schedule": "",
        "earliest_time": "864000",
        "latest_time": "86400"
      },
      "search": "| search `notable` | search dest={dest} | table _time, rule_name, owner, priority, severity, status_description"
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2017-09-20",
  "name": "Get Notable History",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "spec_version": 2,
  "type": "splunk",
  "version": "2.0"
}