Splunk Enterprise Security

Correlation search: email notification subject line

pavanbmishra
Path Finder

Dear Helpful bloggers, morning

I have question on rule action:
While setting Adaptive Response Actions for Correaltion Search for Send Email, can we choose other useful variables along with $name$. It is confusing when email trigger with simply the correaltion search name without src ip, host or something to distictive identification.

Thanks in advance

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Have you tried tokens in email subject line ? Ref. doc https://docs.splunk.com/Documentation/Splunk/7.3.1/Alert/EmailNotificationTokens#Result_tokens

For example : Splunk Alert: Correlation Name Source - $result.src$ Dest - $result.dest$

0 Karma

pavanbmishra
Path Finder

Yes i have gone thorugh the link but seems like it is having limited tokens and not the one i am looking forward here. Is there any way around in future enhancement

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...