Getting Data In

Splunk Priority

debjit_k
Path Finder

Hi All,

 

Just wanted to know we have splunk ES and we use servicenow to triggered alert now my question is if there are few alert which I want to give Priority as P2 how can I do it in splunk as splunk by default priority is P3. 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k ,

are you speaking of Splunk Support priority or Priority in ES Correlation searches?

if Splunk Support, you define the Priority of your Cases when you oprn them.

If you're speaking of Priority in ES Correlation Searches, it's assigned to the associated assets or identities and with the Severity of the Correlation Search it determines the Urgency of a Notable.

Ciao.

Giuseppe

 

0 Karma

debjit_k
Path Finder

Hi @gcusello,

Thanks for the response 

I'm talking about splunk ES correlation search. I put the splunk notable priority as high but when it is generating ticket at servicenow it is coming as P3, not sure why. Can you please help me to fix this issue 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @debjit_k,

I don't know how this add-on works and I don't know python, but priority is defined in the code of one of the python scripts (snow_incident_base.py) that you can find in bin folder.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...