Building for the Splunk Platform

Is it expected : Workflow action visible under action for notable events on incident review on enterprise security

ekta_dravid
New Member
  1. I had a add-on created with prefix TA-XYZ(having Adaptive response action) and one app say "ABC", which has workflow action defined.
  2. When I merged TA-XYZ code to ABC I am now seeing the workflow actions under actions for notable events in incident review page as well.
  3. I don't want my workflow actions to be visible under incident review on enterprise security. Is there any way to disable them on incident review ?

Note - While merging I renamed ABC to TA-ABC as i was not able to see Adaptive response action created in the merged code and after renaming ABC to TA-ABC I was able to see my adaptive response action.

0 Karma

woodcock
Esteemed Legend

This is kludgey but you can add a hidden field like _indextime to your workflow_action (you don't need to actually use it; just require it to be present) and then make sure that your incidents do not have this field (actually I am pretty sure that they will not).

0 Karma

ekta_dravid
New Member

One more point to add I updated the permission form Global" to "App only". But still the actions are visible under Enterprise Security.

0 Karma

woodcock
Esteemed Legend

Try _bumping.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...