Splunk Dev

Is it expected : Workflow action visible under action for notable events on incident review on enterprise security

ekta_dravid
New Member
  1. I had a add-on created with prefix TA-XYZ(having Adaptive response action) and one app say "ABC", which has workflow action defined.
  2. When I merged TA-XYZ code to ABC I am now seeing the workflow actions under actions for notable events in incident review page as well.
  3. I don't want my workflow actions to be visible under incident review on enterprise security. Is there any way to disable them on incident review ?

Note - While merging I renamed ABC to TA-ABC as i was not able to see Adaptive response action created in the merged code and after renaming ABC to TA-ABC I was able to see my adaptive response action.

0 Karma

woodcock
Esteemed Legend

This is kludgey but you can add a hidden field like _indextime to your workflow_action (you don't need to actually use it; just require it to be present) and then make sure that your incidents do not have this field (actually I am pretty sure that they will not).

0 Karma

ekta_dravid
New Member

One more point to add I updated the permission form Global" to "App only". But still the actions are visible under Enterprise Security.

0 Karma

woodcock
Esteemed Legend

Try _bumping.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...