All Apps and Add-ons

AppInspect tool does not allow action.email.to by default entry in the alerts

eduardKiyko
Explorer

Hello everyone!
Recently i faced an issue with appinspect and email alert action. I got this message:

"Alert name" has specified the `action.email.to` property with a provided value. This should be left empty or removed. File: default/savedsearches.conf Line Number: 50

However, if I put the email into action.email.cc it works, but I need to have an email address in the "to" option(which is kinda weird on my opinion).
In the Splunk dev documentation(https://dev.splunk.com/enterprise/docs/releaseapps/appinspect/appinspectreferencetopics/splunkappins...) it's also mentioned:

Check that email alerts (action.email.to) set in savedsearches.conf do not have a default value.

But my client currently has Splunk Cloud deployment and we want just to put all the alerts into private app for internal usage.
So, it there any way to omit this issue? Because it looks like I cannot upload the private app to the Splunk Cloud having alerts with "email.to" option.

0 Karma

PavelP
Motivator

Hello @eduardKiyko,

your observation is correct, the appinspect checks action.mail.to only and ignores action.mail.cc

@splunk_appinspect.tags("splunk_appinspect", "savedsearches")
@splunk_appinspect.cert_version(min="1.1.8")
def check_for_emails_in_saved_search(app, reporter):
    """Check that email alerts (action.email.to) set in `savedsearches.conf`
    do not have a default value.
    """

    saved_searches = app.get_saved_searches()
    if saved_searches.configuration_file_exists():
        file_path = os.path.join("default", "savedsearches.conf")
        for search in saved_searches.searches():
            for key, value in iteritems(search.args):
                if key == "action.email.to":
                    reporter_output = (
                        "The saved search {} has specified the"
                        " `action.email.to` property with a"
                        " provided value. This should be left"
                        " empty or removed. File: {}, Line: {}."
                    ).format(search.name, file_path, value[1])
                    if value:
                        reporter.fail(reporter_output, file_path, value[1])
    else:
        reporter_output = "No savedsearches.conf exists."
        reporter.not_applicable(reporter_output)

you can remove action.mail.to to pass the appinspect and find a way to use it in local/savesearches.conf

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...