Update risk_guide_searches.md

suggest notable suppression instead of editing macro
splunk · Oct 1, 2024 · e1c0aec · e1c0aec
1 parent a35b38e
commit e1c0aec
Showing 1 changed file with 4 additions and 8 deletions.
diff --git a/docs/searches/risk_guide_searches.md b/docs/searches/risk_guide_searches.md
@@ -52,16 +52,12 @@ index=notable eventtype=risk_notables
 
 ## Structural Changes
 
-### Notable Macro to Edit for QA Risk Notables
+### Notable Suppression for QA Risk Notables
 
-Add `| eval QA=1` to the end of your Risk Incident Rules, editing the macro `get_notable_index` from the default to begin "QA" mode.
-
-```shell title="default"
-index=notable
-```
+Add `| eval QA=1` to the end of your Risk Incident Rules, then go to Configure → Incident Management → Notable Event Suppressions, and create a new suppression for:
 
 ```shell title="QA mode"
-index=notable NOT QA=1
+index=notable QA=1
 ```
 
 This will keep Risk Notables out of your Incident Review queue while you develop RBA.
@@ -194,4 +190,4 @@ For tuning Risk Incident Rules that don't rely on an accretive score to alert, b
   <img class="github-avatar" src="https://avatars.githubusercontent.com/u/12771156?v=4){ class="github-avatar"/>
  </a>
  <span class="zts-tooltip-text">@7thdrxn - Haylee Mills</span>
-</div>
+</div>