I'm trying out a Adaptive response action of VirusTotal which i created by following this site http://dev.splunk.com/view/addon-builder/SP-CAAAFBQ.
The following screnarios are working
However on the same correlation search If I try to pass on the parameter as $url$ it fails to execute and I get failure under Notable events details.
The correlation search query is basic one which reads data from a lookup table which contains only one column called url. It returns the URL
Correlation Search query
| inputlookup demoARdata | where isnotnull(url)
Adaptive response action
Error Message in log file VirusTotal_modalert.log
2017-11-27 19:16:38,641 INFO pid=16371 tid=MainThread file=setup_util.py:log_info:114 | Log level is not set, use default INFO
2017-11-27 19:16:38,642 ERROR pid=16371 tid=MainThread file=cim_actions.py:message:271 | sendmodaction - signature="url is a mandatory parameter, but its value is None." action_name="VirusTotal" search_name="Threat - Splunk alert $url$ - Rule" sid="scheduler_adminSplunkEnterpriseSecuritySuite_RMD5839fb9bced15ebfc_at_1511790360_253" rid="0" app="SplunkEnterpriseSecuritySuite" user="admin" action_mode="saved" action_status="failure"
Not sure where I went wrong? 😞
You can try
However though this will work for an event, it is not the most correct way. Inside your code, you should pull and loop through all urls for all events sent into the AR in case it is somehow used on multiple events. So really you don't want to pass url at all. You want to just pull it from each event sent to the AR and execute per result.