Getting Data In

My Playbook cannot be find in Alerts dashboard

dadataz
Explorer

Hello,

I'm on Splunk 7.3.3

with the "Security Monitoring for Splunk" https://splunkbase.splunk.com/app/4131

I have install all the addons.

I have create a Playbook Entries, but when i try to find it in the dashboard "Alerts" where you can find all your schedule alerts, i only have my personnal rules, rules from this app but not my new rules.
I notice on the playbook the owner is admin and the others pre-rules are Monitoring App.

Any idea why i can't find my rule ? I cannot configure the workflow in this case.

Best regards

0 Karma

dadataz
Explorer

I check the "Searches, Reports, and Alerts" for the "App: Security Monitoring for Splunk (security_monitoring_for_splunk)"
I find the default rule for exemple : "5001-INV-Incorrectly_Routed_DNS_Traffic" when you click on edit just show Edit permission, Edit Alert Disable, Advanced Edit and Clone.
Instead the rules i have create have : edit Search, Edit Permissions, Edit Schedule, Edit Acceleration, Edit Summary Indexing, Disable, Advanced Edit, clone, embed, move and Delete.

0 Karma

dadataz
Explorer

I just saw this is creating a report, not an alert.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...