topic Re: Ad hoc adaptive response executed twice in Splunk Enterprise Security

Ad hoc adaptive response executed twice

goran_epl — Fri, 29 Jan 2021 16:45:06 GMT

Hello,

I've created adaptive response action with Add-on builder 3.0.1. It creates a ticket in ticketing system.

Splunk enterprise security 6.2.0 is running in a cluster. Indexers are also clustered, multi-site. Splunk is 8.0.6.

When action is triggered from saved alert, it works perfectly. When running ad hoc action from Incident review page the script gets executed twice and creates two same tickets. There is a 5 seconds difference between two actions.

Why would it be executed twice?

Goran

Re: Ad hoc adaptive response executed twice

ebond_splunk — Fri, 19 Feb 2021 17:56:35 GMT

@goran_epl

Were you able to find a solution? If so, there's a similar situation occurring with another customer and we're trying to figure out a solution. The issue is that we can't replicate what's going on. Any ideas?

Re: Ad hoc adaptive response executed twice

morawi5 — Fri, 09 Apr 2021 17:45:50 GMT

We are also seeing the same exact situation on Splunk 8.1.1 and ES 6.4.1

Re: Ad hoc adaptive response executed twice

morawi5 — Fri, 09 Apr 2021 17:46:41 GMT

@Anonymous @ebond_splunk - Are you also seeing duplicates when using something like "ping" too?

Re: Ad hoc adaptive response executed twice

ebond_splunk — Fri, 09 Apr 2021 17:50:45 GMT

Hey @morawi5 , yep, we figured out that all dispatched adhoc mod actions are duplicating. But we also discovered the problem and implemented a fix for the next maintenance release. If you have access to your splunk instance files, I can show you what file to update. It's a one liner fix in python. Let me know!

Re: Ad hoc adaptive response executed twice

morawi5 — Fri, 09 Apr 2021 18:04:36 GMT

Yep, I do have access, just private messaged you.

Re: Ad hoc adaptive response executed twice

goran_epl — Mon, 12 Apr 2021 07:06:09 GMT

Yes please. We would like to give a shot with one liner fix in python.

Can you please send it?

Re: Ad hoc adaptive response executed twice

morawi5 — Mon, 12 Apr 2021 12:33:19 GMT

So you'll need to open file "etc/apps/Splunk_SA_CIM/bin/modaction_adhoc_rest_handler.py". And add to line 561.

'preview': 'false',

Basically you'll want the code block to look like this:

args = {
    'output_mode': 'json',
    # CIM-944: adhoc_search_level essential to proper field extraction
    'adhoc_search_level': 'verbose',
    'preview': 'false',
    'search': search
}

Restart afterwards - This worked from me, kudos to @ebond_splunk