Splunk Enterprise Security

Bulk manage adaptive response (send email) for Content Management in ES

cachexploit
Explorer

Since I have gone through and tuned a lot of the Content in ES, I am looking to see if anyone knows of a Bulk way to add an Adaptive Response (as in send an email) for every Incident Created?  I am at the point now where things are in a good place and I would not be overwhlemed with the amount of emails that would come in from the Incidents BUT now I want to send an email for every one that is created but I don't want to have to go through Content Management and set an adaptive response for EVERY SINGLE one that is enabled.

For a little more info, I am using Splunk Cloud and ES. so any back end things I would have to submit a ticket to support (which I am not against doing, just want to make sure that is the route I need to go).

TIA

Tags (1)
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...