My SOC wants a page showing all recent notables, and which ones were suppressed by the current suppression rules. Obviously I can list notables with
index=notable
but how can I easily indicate the ones that actually showed up in Incident Review vs. the ones that were suppressed?
↧