topic Re: Modular Action Alert does not appear in the UI (Own App) - Configuration and logs verified. in Feedback

Modular Action Alert does not appear in the UI (Own App) - Configuration and logs verified.

kenlymarP — Mon, 03 Nov 2025 00:15:37 GMT

I am implementing a custom Modular Alert Action in Splunk 10.x, but the action does not appear in the Add Actions dropdown menu of the alerts, even though we have checked the syntax and the main logs.
All files are correctly located within the n8n_integration app,

...\n8n_integration\default\alert_actions.conf --> file alert_actions.conf
...\n8n_integration\bin\payload_attack_force_brute_n8n.py --> script
...\n8n_integration\data\ui\alerts\payload_attack_force_brute_n8n.html --> UI

Contents of alert_actions.conf

[payload_attack_force_brute_n8n]
label = Enviar Alerta N8N
description = Envia payload JSON de alerta de Fuerza Bruta a n8n
is_custom = 1
payload_format = json
python.version = python3
icon_path = n8n_integration/static/brute-force-attack-icon.png

Diagnosis Performed and Discarded

I checked the python.log after reboot and when loading the alert page. There are no FATAL/ERROR errors related to the loading of the modular action script.
The stanza ([payload_attack_force_brute_n8n]) exactly matches the .py and .html file names.

Any suggestions on where to look for a silent loading error or if there is a missing syntax in the stanza would be greatly appreciated.

Re: Modular Action Alert does not appear in the UI (Own App) - Configuration and logs verified.

livehybrid — Mon, 03 Nov 2025 14:47:04 GMT

Hi @kenlymarP

Please check two things, in the metadata for your app; metdata/default[or local].meta do you have the alert_actions exported globally? e.g.

[alert_actions] export = system # OR [] export = system

(See https://dev.splunk.com/enterprise/docs/devtools/customalertactions/configappcaa/#:~:text=Admin%20Manual.-,Export%20the%20alert%20action%20globally,-Export%20the%20alert)

Secondly, if you go to http://yourSplunkInstance:8000/en-US/manager/search/alert_actions do. you see you alert action, if so, is it Enabled?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Modular Action Alert does not appear in the UI (Own App) - Configuration and logs verified.

kenlymarP — Tue, 04 Nov 2025 00:15:26 GMT

Hi, sorry for the delay.
I didn't have it exported to the system. I have added it to the metdata/default. However, it still does not appear in the web interface.
Regarding the second option, it does not appear in the Alert Actions section.
Any other suggestions please? @livehybrid

I forgot to mention that I have splunk in a VM (VirtualBox), it is a lab to get experience using Splunk since I am new starting in cybersecurity. I already checked the permissions in my n8n_integration directory where the SYSTEM user has the necessary permissions.