Alerting

Setting up email alerts for Enterprise Security

greenpebble
Explorer

Hi there, 

I'm looking to setup an automated email that will trigger any time a new alert comes into Incident Review in Splunk ES (using Splunk>enterprise). The idea is for the team to be notified without having the Incident Review page open and improve response time. I know I can set emails individually when a alert triggers, but this would be for every 'new' alert (there are some alerts that are autoclosing) that comes in or with an option to only target high urgency alerts based on volume. 

Any advice would be appreciated!

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @greenpebble ,

at first, there's no sense in this approach because the Incident Review page should be the main page of every SOC Analyst and should be always open, otherwise, you don't need ES!

Anyway, if you want also an eMail, at every Correlation Search you enabled, you can add as additional Action sending an eMail, in this way the SOC Analysts will receive an eMail every time a Notable is written.

You can do this editing the Actions of every Correlation Search.

Beware because maybe in this way you are creating a spammer!

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @greenpebble ,

at first, there's no sense in this approach because the Incident Review page should be the main page of every SOC Analyst and should be always open, otherwise, you don't need ES!

Anyway, if you want also an eMail, at every Correlation Search you enabled, you can add as additional Action sending an eMail, in this way the SOC Analysts will receive an eMail every time a Notable is written.

You can do this editing the Actions of every Correlation Search.

Beware because maybe in this way you are creating a spammer!

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @greenpebble ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...