Setting up email alerts for Enterprise Security

[greenpebble]

Hi there, 

I'm looking to setup an automated email that will trigger any time a new alert comes into Incident Review in Splunk ES (using Splunk>enterprise). The idea is for the team to be notified without having the Incident Review page open and improve response time. I know I can set emails individually when a alert triggers, but this would be for every 'new' alert (there are some alerts that are autoclosing) that comes in or with an option to only target high urgency alerts based on volume. 

Any advice would be appreciated!

[gcusello · Accepted solution]

Hi @greenpebble ,

at first, there's no sense in this approach because the Incident Review page should be the main page of every SOC Analyst and should be always open, otherwise, you don't need ES!

Anyway, if you want also an eMail, at every Correlation Search you enabled, you can add as additional Action sending an eMail, in this way the SOC Analysts will receive an eMail every time a Notable is written.

You can do this editing the Actions of every Correlation Search.

Beware because maybe in this way you are creating a spammer!

Ciao.

Giuseppe

[gcusello]

Hi @greenpebble ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉