All Apps and Add-ons

Alert Manager: How to assign a priority based on search?

redacted
Explorer

How to assign a priority based on search?

Is it possible to assign a priority based on a search, similar to the way you can assign a user? Or used to be able to as per: https://answers.splunk.com/answers/426909/alert-manager-how-to-assign-a-certain-incident-to.html

Thanks

1 Solution

redacted
Explorer

from the alert manager gui

Default urgency for incidents of this alert.
Note: The urgency can be overriden by a field from search results named 'urgency'. Later, the alert manager calculates a priority based on the impact and urgency.

View solution in original post

0 Karma

redacted
Explorer

from the alert manager gui

Default urgency for incidents of this alert.
Note: The urgency can be overriden by a field from search results named 'urgency'. Later, the alert manager calculates a priority based on the impact and urgency.

0 Karma

redacted
Explorer

so far I have been able to get this

index=main name=bad thing threat>=80 threat<=100 ( alert is created high)
index=main name=bad thing threat>=40 threat<=79 (alert is created med)
index=main name=bad thing threat>=0 threat<=39 (alert is created low)

the threat is a field that I am parsing in my alert search query, unfortunately I have to use 3 searches if not 5 for all of the alert manager "priority" options on the incident posture

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...