Splunk Enterprise Security

Correlation search: email notification subject line

pavanbmishra
Path Finder

Dear Helpful bloggers, morning

I have question on rule action:
While setting Adaptive Response Actions for Correaltion Search for Send Email, can we choose other useful variables along with $name$. It is confusing when email trigger with simply the correaltion search name without src ip, host or something to distictive identification.

Thanks in advance

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Have you tried tokens in email subject line ? Ref. doc https://docs.splunk.com/Documentation/Splunk/7.3.1/Alert/EmailNotificationTokens#Result_tokens

For example : Splunk Alert: Correlation Name Source - $result.src$ Dest - $result.dest$

0 Karma

pavanbmishra
Path Finder

Yes i have gone thorugh the link but seems like it is having limited tokens and not the one i am looking forward here. Is there any way around in future enhancement

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...