Alerting

Is there a best way sent alert content to a API interface of other system

bestSplunker
Contributor

I have a SOC (Security Operation Center) that has an API to receive alert content from splunk(splunk version 6.4.4).When the alert is triggered, I hope Splunk can send the alert contents to SOC API. So what way should I send the alert type to SOC API?
The fields and contents of each alert are different. In addition, it can be formatted as JSON?
Should I use the Run a script action? Is there a best way sent alert content to SOC API ?

Tags (1)
0 Karma
1 Solution

pradeepkumarg
Influencer

Yes, you can use webhook and Specify an URL to send JSON payload via HTTP POST. Refer below documentation.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Alert/Webhooks

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Run a script is a deprecated feature, though I don't believe that it is in version 6.4.4. I would suggest doing a future-proof way of handling this, though I'm not sure if version 6.4.4 has an alternative (it has been a while since I ran 6.4, but I believe that this functionality will go back to 6.3). In recent releases you can create an custom alert action and send any of the applicable data from the search to the API that you are using. It won't have to be a JSON string through a REST API if your API doesn't handle that. You can program any type of interface that you need. The custom alert action also has many UI advantages over the Run a script action. Here is some documentation that might prove helpful to you:

http://docs.splunk.com/Documentation/Splunk/6.4.4/AdvancedDev/ModAlertsIntro

pradeepkumarg
Influencer

Yes, you can use webhook and Specify an URL to send JSON payload via HTTP POST. Refer below documentation.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Alert/Webhooks

0 Karma

bestSplunker
Contributor

@gpradeepkumarreddy ok, So My SOC system needs access result_link of json payload, then can get the alert content

0 Karma

pradeepkumarg
Influencer

This is the other way around, Splunk posts the response to the URL you specify.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...