Risk Notable Tuning

[ZachTheSplunker]

Asked in the #risk-based slack channel

I am trying to find a way to implement a tuning option when an alert triggers that will also exclude the alert from prior risk scores so as not to retrigger a risk alert with old data.

[ZachTheSplunker]

Answers provided in the #risk-based slack channel

• Deduplicate Notables: https://splunk.github.io/rba/searches/deduplicate_notables/
• Suggestions starting on Page 23 of the RBA guide: https://www.splunk.com/en_us/pdfs/gated/ebooks/the-essential-guide-to-risk-based-alerting.pdf