topic Re: How to pass field value to custom alert action? in Splunk Enterprise Security

How to pass field value to custom alert action?

wlight600 — Tue, 29 Sep 2020 23:53:05 GMT

Hi!
I'm creating custom alert action. I can use my alert action in save alert and Correlation search. But I meet a trouble.
When I type my string to alert action, it worked and my script received string. But I type variable string like: $src_ip$ is evil. After run this alert action, I found that I can received Notable events, but src_ip field is null.
How to pass Notable event field values to alert action?

Re: How to pass field value to custom alert action?

harsmarvania57 — Wed, 27 Mar 2019 19:25:35 GMT

Hi,

Can you please try $result.src_ip$ instead of $src_ip$ ?

Re: How to pass field value to custom alert action?

wlight600 — Thu, 28 Mar 2019 01:45:19 GMT

You mean, I pass value when creating correlation search, I should use $result.src_ip$? Whether need I write some configuration in any conf ?

Re: How to pass field value to custom alert action?

harsmarvania57 — Thu, 28 Mar 2019 12:24:33 GMT

If you are using your custom alert action directly in your search with sendalert command then yes you can pass $result.src_ip$ to your custom alert action. Have a look at https://docs.splunk.com/Documentation/Splunk/7.2.5/AdvancedDev/ModAlertsLog

Re: How to pass field value to custom alert action?

wlight600 — Fri, 29 Mar 2019 06:10:23 GMT

Uh, your first answer is right. I just write html and restart splunk, no need to moidfy configuration.Thnx!

Re: How to pass field value to custom alert action?

wlight600 — Mon, 01 Apr 2019 05:41:05 GMT

I meet another trouble. When I want to use alert action in Incident Review, I can't find this action in Run Adaptive Response Actions. How do I config to invoke aler action in Incident Review. Thank you very much!

Re: How to pass field value to custom alert action?

harsmarvania57 — Mon, 01 Apr 2019 07:51:24 GMT

Have a look at this doc https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps , you need to configure ES so that it will import config from your custom alert actions app.

Re: How to pass field value to custom alert action?

wlight600 — Mon, 01 Apr 2019 08:04:32 GMT

I had already import custom app at first. It seems that not work!

Re: How to pass field value to custom alert action?

harsmarvania57 — Mon, 01 Apr 2019 08:13:32 GMT

What's your custom app name which contain alert action config ? and can you please provide ES app_imports_update://update_es configuration ?

Re: How to pass field value to custom alert action?

lakshman239 — Mon, 01 Apr 2019 10:49:17 GMT

When you create custom alert action, you need to tick 'support' ad-hoc invocations [ you can see this when you build the add-on using Add-on builder], so the alert actions can work in ES framework and will be available in the list of adaptive response. http://dev.splunk.com/view/addon-builder/SP-CAAAFBS

Re: How to pass field value to custom alert action?

wlight600 — Mon, 01 Apr 2019 11:47:02 GMT

I create it with manual, so I want to know manual to do !

Re: How to pass field value to custom alert action?

wlight600 — Mon, 01 Apr 2019 11:51:55 GMT

Re: How to pass field value to custom alert action?

harsmarvania57 — Mon, 01 Apr 2019 12:15:43 GMT

That looks good, have you updated it via modifying conf file directly OR have you updated in Splunk ES Web ? If you updated it via modifying conf file directly then you need to restart splunk.

EDIT: You need to restart Splunk no matter how you modified it. See point 6 and 5 on this doc https://docs.splunk.com/Documentation/ES/5.2.2/Install/ImportCustomApps#Import_add-ons_with_a_different_naming_convention

Re: How to pass field value to custom alert action?

wlight600 — Wed, 30 Sep 2020 00:00:44 GMT

Uh，official doc was misleaded me. I set up param.cam in alert_actions.conf. It's appeared! Thank you for helping me! ^^

Re: How to pass field value to custom alert action?

muhammad_luthfi — Tue, 10 Sep 2024 23:46:53 GMT

Hi @harsmarvania57 ,

Thanks, it's working with BMC Helix integration 🙂