topic Re: Splunk ES - Adaptive Response - Send Email per Result of Correlation Search in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Adaptive-Response-Send-Email-per-Result-of-Correlation/m-p/433401#M5688 <P>Lets say you have a field called myemail_addr in each of the 5 events, resulting from your correlation search, you can use that as a token $myemail_address$ in the email adaptive response to send different email to each of the 5 users. would this help?</P> Tue, 29 Sep 2020 22:41:35 GMT lakshman239 2020-09-29T22:41:35Z Splunk ES - Adaptive Response - Send Email per Result of Correlation Search https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Adaptive-Response-Send-Email-per-Result-of-Correlation/m-p/433400#M5687 <P>Hey Team,</P> <P>Wanted to be able to send an email as an Adaptive Response for a correlation search per result. Just like a notable event is created per-event, is there a way to configure the "Send Email" to be sent per-event, based on information in the notable event?</P> <P>For example, if a correlation search has 5 hits, 5 notable events are created. Let's say there are 5 different email addresses on these 5 events; is it possible to use "$result.email$" to alter who get the email per event?</P> <P>I know a limitation or the design of $result.email$ is just to take the first row, but was thinking when used in conjunction with Correlation search, there might be a way to utilize the Adaptive Response per event.</P> <P>Thoughts? Any additional data needed? Thanks all!</P> Mon, 10 Dec 2018 22:38:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Adaptive-Response-Send-Email-per-Result-of-Correlation/m-p/433400#M5687 gworkun 2018-12-10T22:38:36Z Re: Splunk ES - Adaptive Response - Send Email per Result of Correlation Search https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Adaptive-Response-Send-Email-per-Result-of-Correlation/m-p/433401#M5688 <P>Lets say you have a field called myemail_addr in each of the 5 events, resulting from your correlation search, you can use that as a token $myemail_address$ in the email adaptive response to send different email to each of the 5 users. would this help?</P> Tue, 29 Sep 2020 22:41:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Adaptive-Response-Send-Email-per-Result-of-Correlation/m-p/433401#M5688 lakshman239 2020-09-29T22:41:35Z