All Apps and Add-ons

Can I have multiple Alert Manager apps


We have been using Alert Manager for a while now and for the most part will continue to use it moving forward. However I am wanting to know if there is a possibility to have seperate Alert Manager consoles for different tasks (I want to avoid having the "plain jane alerts" within each app if possible. For example we have the following scenario (these are made up to illustrate what I am trying to do):

  • SOC Team 1 looks after Environment 1 "WORKSTATIONS"
  • SOC Team 2 looks after Environment 2 "IOT"

Within the SPLUNK Serach Head I have an application for each team - "SOC Team 1" and "SOC Team 2" with their respective dashboards.

Our SPLUNK SIEM ingests logs for both and there are alerts (use cases) generated from both. I would like to have Alert Manager show alerts for the "WORKSTATIONS" environment to SOC Team 1 in Alert Manager but not be visible or shown to SOC Team 2 and vice-versa. Is there an option in Alert Manager to do this (I haven't seen anything specifically related to this)? Can the application be "cloned" as such so that I have 2 Alert Manager apps installed with the relevant configurations?

ES is something that will happen in the future but for the moment the focus is on this.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...