topic Repost: Assign different Label with different use case within the same Asset in Splunk SOAR

Repost: Assign different Label with different use case within the same Asset

AliMaher — Fri, 24 Oct 2025 01:02:48 GMT

Hello SOARians,

I am thinking of a scenario where an external alert from a SIEM like qRadar or Elastic should trigger a playbook. For example, a bruteforce alert should trigger a bruteforce playbook, a portscan alert should trigger a portscan playbook, and so on. Unfortunately, it is only possible to assign the same labels to all incoming SIEM alerts. Based on these labels a playbook is then executed.

Is there any way to assign the labels based on the type (e.g. a field of the alarm) of the incoming alarm or to solve the difference between alarms in another way?

Re: Repost: Assign different Label with different use case within the same Asset

phanTom — Fri, 24 Oct 2025 07:13:43 GMT

@AliMaher if you can't create a different label at the creation and time the container in SOAR is created, then the next best approach would be to have a "Landing Playbook" that all the alerts come into and are then sent down the correct path.

This can be done either by simply connecting the right playbook to the output of a decision, or you can switch the label on the container which will then call the associated active playbook(s) that are set to use that label.

-- Happy SOARing! If this helped please leave some karma. If it resolved the issue please mark as a solution for others to see. --