topic Re: About warning showing in Splunk Cloud message box in Splunk Cloud Platform

About warning showing in Splunk Cloud message box

Anurag — Tue, 20 Aug 2024 16:21:20 GMT

Recently, I observed a message in Splunk Cloud (version 9.2.2403.105) stating, "Found an empty value in 'allowedDomainList' in alert_actions.conf." However, when I check the "Allowed Domain" setting in the UI by navigating to "Settings > Server settings > Email," it indicates "Leave empty for no restrictions." Despite this, I am still seeing the warning message.

#splunkcloud #splunk

Re: About warning showing in Splunk Cloud message box

richgalloway — Tue, 20 Aug 2024 18:57:48 GMT

The bulletin message is trying to help you avoid data exfiltration by saying content in alert actions can go anywhere in the world. It will appear if the allowedDomainList is empty. If you are OK with that then you can ignore the message.

If you prefer to limit alert actions to your own domain (and/or others) then update the allowedDomainList and the bulletin messages will stop.

I'm not aware of a way to have an empty allowedDomainList and not get the warning message.

Re: About warning showing in Splunk Cloud message box

JyPl4wNYu7GV1uL — Mon, 28 Oct 2024 16:33:49 GMT

I just upgraded to 9.3.1 and was also getting that warning. I set a value for allowedDomainList in system/local/alert_actions.conf, restarted the daemon, but I still get the message.

Just wanted to post in case other experience the same behavior.

Re: About warning showing in Splunk Cloud message box

JyPl4wNYu7GV1uL — Mon, 28 Oct 2024 16:41:11 GMT

Disregard. I had put the setting in the [default] stanza, moved it to the [email] stanza, now the warning has resolved.

Security risk warning: Found an empty value for 'allowedDomainList' in the alert_actions.conf configuration file....

LS1 — Wed, 16 Jul 2025 19:37:04 GMT

Hello,

I have this instance on my personal computer and am a little confused about how to protect myself. I do not know which (or how to determine) allowedDomainList I should use. Where do I find the necessary information to fill that field in?

Sorry, still a beginner..

Re: Security risk warning: Found an empty value for 'allowedDomainList' in the alert_actions.conf configuration file....

richgalloway — Thu, 17 Jul 2025 11:46:51 GMT

The allowedDomainList setting can be in any alert_actions.conf file on your search head(s). Precedence rules apply, however. See https://docs.splunk.com/Documentation/Splunk/9.4.2/Admin/Wheretofindtheconfigurationfiles