Add-On for AWS: Adjust the aws sns alert output js...

Alerting

Hello Splunk community!

Since a few days I am trying to adjust the output JSON file of the AWS SNS alert.

The alert template for the AWS SNS alert gives me only a specific amount of fields I can "export" into the AWS bucket as a JSON file (to the AWS topic).

But I would like to enter more fields manually. I have already tried to adjust the .py files on the server itself, but I would like to use a self-defined JSON format.

The used search contains all the needed fields, but they are not used by the .py script for sending the alert to AWS.

Has anyone an idea or have already had the same question?

Thanks a lot and happy splunking 🙂

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with another ...