Notables appearing in the Incident Review dashboard after several days

Applicability

Description

The difference in event counts between the notable macro (`notable`) and the Incident Review dashboard as follows.

Notable Macro:

There are 4 notable events in the IR dashboard and 10 notable events in the notable macro search. 

Investigation

A notable discrepancy in event counts was observed between the notable macro and the incident review dashboard.

A closer examination of the event type field within the notable macro identified several event types that were suppressed during the specified time frame. 



When the suppressed event types were excluded from the notable macro, the counts aligned with those in the main search of the incident review. The analysis indicates that a configuration for event type-based suppression was in effect, impacting visibility during the specified period. 

Once the events fell outside the suppression period, they became visible in the incident review dashboard, confirming the impact of the suppression settings. 

The below mentioned search helps you to identify the event from a particular correlation search that is being suppressed

| search eventtype=*_suppression*| table eventtype search_name| dedup search_name 

Resolution

To resolve the issue, follow these steps:

1. Navigate to Event Types:
   - Go to Settings > Event Types

2.  Locate the specific event type that has suppression settings applied.

3. Click on the identified event type to access its details and configuration.

4. Modify or remove any restrictive suppression conditions affecting visibility.

5. Click Save to apply the updates to the event type configuration.