thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Notable Event

An event generated by a Splunk Enterprise Security correlation search that requires analyst review.

Definition

Notable events appear in Incident Review with urgency calculated from severity and asset or identity priority, and are assigned owners and statuses. In newer ES versions they are presented as findings within investigations. They are the unit of work for ES analysts.

Example

A notable for "Brute Force Access Behavior Detected" with high urgency because the target is a domain controller.

Exam tip

Urgency in ES combines event severity with asset/identity priority.

Related terms