All Apps and Add-ons

AppInspect tool does not allow action.email.to by default entry in the alerts

eduardKiyko
Explorer

Hello everyone!
Recently i faced an issue with appinspect and email alert action. I got this message:

"Alert name" has specified the `action.email.to` property with a provided value. This should be left empty or removed. File: default/savedsearches.conf Line Number: 50

However, if I put the email into action.email.cc it works, but I need to have an email address in the "to" option(which is kinda weird on my opinion).
In the Splunk dev documentation(https://dev.splunk.com/enterprise/docs/releaseapps/appinspect/appinspectreferencetopics/splunkappins...) it's also mentioned:

Check that email alerts (action.email.to) set in savedsearches.conf do not have a default value.

But my client currently has Splunk Cloud deployment and we want just to put all the alerts into private app for internal usage.
So, it there any way to omit this issue? Because it looks like I cannot upload the private app to the Splunk Cloud having alerts with "email.to" option.

0 Karma

PavelP
Motivator

Hello @eduardKiyko,

your observation is correct, the appinspect checks action.mail.to only and ignores action.mail.cc

@splunk_appinspect.tags("splunk_appinspect", "savedsearches")
@splunk_appinspect.cert_version(min="1.1.8")
def check_for_emails_in_saved_search(app, reporter):
    """Check that email alerts (action.email.to) set in `savedsearches.conf`
    do not have a default value.
    """

    saved_searches = app.get_saved_searches()
    if saved_searches.configuration_file_exists():
        file_path = os.path.join("default", "savedsearches.conf")
        for search in saved_searches.searches():
            for key, value in iteritems(search.args):
                if key == "action.email.to":
                    reporter_output = (
                        "The saved search {} has specified the"
                        " `action.email.to` property with a"
                        " provided value. This should be left"
                        " empty or removed. File: {}, Line: {}."
                    ).format(search.name, file_path, value[1])
                    if value:
                        reporter.fail(reporter_output, file_path, value[1])
    else:
        reporter_output = "No savedsearches.conf exists."
        reporter.not_applicable(reporter_output)

you can remove action.mail.to to pass the appinspect and find a way to use it in local/savesearches.conf

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...