Alerting

Configure a script as alert action for each result ip and send email

orca
Explorer

1. I have an alert scheduled to run every hour to get updated list of IPs of public nodes.

2. I need to run the script against each result IP and if output=success, I need to send email to specific DL to identify potential hacking activity from the IP.

possible? Can we measure the output of script execution and send email in same Alert action OR I should create the script to test the result and send email also from the script?

Any pointers or am i missing something?

Labels (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

You can convert that script to a custom search command and use the inbuilt email alert action to send emails.

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

You can convert that script to a custom search command and use the inbuilt email alert action to send emails.

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/

If this reply helps you, an upvote/like would be appreciated.

Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...