https://community.splunk.com/t5/Splunk-SOAR/Prompt-email-with-certain-event/m-p/696987#M1540 <P>If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.</P><P>To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.&nbsp; That would look something like</P><PRE>https://10.250.74.118:8443/mission/[number]/analyst/approvals&nbsp;</PRE><P>&nbsp;</P> Wed, 21 Aug 2024 19:53:10 GMT SOARt_of_Lost 2024-08-21T19:53:10Z https://community.splunk.com/t5/Splunk-SOAR/Prompt-email-with-certain-event/m-p/696791#M1539 <P>I have try to prompt with my email.</P><PRE>To execute the requested action, deny or delegate, click here https://10.250.74.118:8443/approval/14.</PRE><P>It need to enter the WEB UI and found the "certain" prompt.<BR />If I have 10000 prompt, I can not found the event related to the email rapidly.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="johnlee2327_0-1724123070546.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32313iC43D65B2DD7ACBD4/image-size/medium?v=v2&amp;px=400" role="button" title="johnlee2327_0-1724123070546.png" alt="johnlee2327_0-1724123070546.png" /></span><BR />&nbsp;If it is possible that use rest api to post prompt decision to soar certain event?</P> Tue, 20 Aug 2024 03:05:49 GMT https://community.splunk.com/t5/Splunk-SOAR/Prompt-email-with-certain-event/m-p/696791#M1539 johnlee2327 2024-08-20T03:05:49Z https://community.splunk.com/t5/Splunk-SOAR/Prompt-email-with-certain-event/m-p/696987#M1540 <P>If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.</P><P>To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.&nbsp; That would look something like</P><PRE>https://10.250.74.118:8443/mission/[number]/analyst/approvals&nbsp;</PRE><P>&nbsp;</P> Wed, 21 Aug 2024 19:53:10 GMT https://community.splunk.com/t5/Splunk-SOAR/Prompt-email-with-certain-event/m-p/696987#M1540 SOARt_of_Lost 2024-08-21T19:53:10Z