Splunk Enterprise Security

Ad hoc adaptive response executed twice

goran_epl
Explorer

Hello,

I've created adaptive response action with Add-on builder 3.0.1. It creates a ticket in ticketing system. 

Splunk enterprise security 6.2.0 is running in a cluster. Indexers are also clustered, multi-site. Splunk is 8.0.6.

When action is triggered from saved alert, it works perfectly. When running ad hoc action from Incident review page the script gets executed twice and creates two same tickets. There is a 5 seconds difference between two actions.

Why would it be executed twice?

Goran

 

Labels (1)
0 Karma

morawi5
Explorer

@gor @ebond_splunk  - Are you also seeing duplicates when using something like "ping" too?

0 Karma

ebond_splunk
Splunk Employee
Splunk Employee

Hey @morawi5 , yep,  we figured out that all dispatched adhoc mod actions are duplicating. But we also discovered the problem and implemented a fix for the next maintenance release.  If you have access to your splunk instance files, I can show you what file to update. It's a one liner fix in python. Let me know!

0 Karma

goran_epl
Explorer

Yes please. We would like to give a shot with one liner fix in python.

Can you please send it?

0 Karma

morawi5
Explorer

 

So you'll need to open file "etc/apps/Splunk_SA_CIM/bin/modaction_adhoc_rest_handler.py". And add to line 561.

'preview': 'false',

  Basically you'll want the code block to look like this:

args = {
    'output_mode': 'json',
    # CIM-944: adhoc_search_level essential to proper field extraction
    'adhoc_search_level': 'verbose',
    'preview': 'false',
    'search': search
}

 Restart afterwards - This worked from me, kudos to @ebond_splunk 

0 Karma

morawi5
Explorer

Yep, I do have access, just private messaged you.

0 Karma

morawi5
Explorer

We are also seeing the same exact situation on Splunk 8.1.1 and ES 6.4.1 

0 Karma

ebond_splunk
Splunk Employee
Splunk Employee

@goran_epl 

Were you able to find a solution? If so, there's a similar situation occurring with another customer and we're trying to figure out a solution. The issue is that we can't replicate what's going on. Any ideas?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.