get_notable_info.json

{
  "creation_date": "2017-03-15",
  "data_metadata": {
    "data_source": [
      "Notable Events"
    ],
    "providing_technologies": [
      "Splunk Enterprise Security"
    ]
  },
  "description": "This search queries the notable index to retrieve detailed information captured within the notable. Every notable has a unique ID associated with it, which is used to point us directly to the notable event under investigation.",
  "entities": [
    "event_id"
  ],
  "how_to_implement": "If you are using Enterprise Security you are likely already creating notable events with your correlation rules. No additional configuration is necessary.",
  "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242",
  "investigate": {
    "splunk": {
      "fields_required": [
        "event_id"
      ],
      "schedule": {
        "cron_schedule": "",
        "earliest_time": "3600",
        "latest_time": "3600"
      },
      "search": "| search `notable_by_id({event_id})` | table time, rule_name, dest, dest_asset_id, dest_owner, priority, severity, owner, status_description"
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2017-09-20",
  "name": "Get Notable Info",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "spec_version": 2,
  "type": "splunk",
  "version": "1.0"
}