Splunk Enterprise Security

Does the service now integration work as an ad hoc adaptive response?

BGrdickson
Explorer

Hi guys,

I have configured my servicenow integration with splunk and it works fine, we can create notables from any scheduled/correlation search. However, does anyone happen to know if we can use this integration to make a notable into a service now incident using an ad hoc adaptive response? It works if its configured as an alert action but we don't want every notable to go into servicenow. Our idea was that notables are tier 1 and then using this manual invocation of the adaptive response, they go into servicenow to become tier 2 events.

Does anyone know if this can be done? In this splunk dev article: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBE under the "Determine whether your action supports ad hoc invocation" it says any action that uses the SENDALERT action should support ad hoc invocation but I'm unsure how to properly check this.

Any advice would be greatly appreciated.

Thanks,

1 Solution

BGrdickson
Explorer

I don't have enough Karma points to attach files so I can't show you a screenshot to what it looks like when it works unfortunately.

I can't remember exactly how I came to this conclusion but I added the following config to alert_actions.conf on my deployer and pushed to our SHC.

[snow_incident]
param._cam = {\
"category" : ["others"],\
"task" : ["others"],\
"subject" : ["others"],\
"technology" : [{"vendor":"unknown", "product":"unknown"}],\
"supports_adhoc" : true\
}
param.state = 1
param.correlation_id = $job.sid$
param.configuration_item = splunk
param.contact_type =
param.assignment_group =
param.category =
param.subcategory =
param.account = splunk_integration
param.short_description =

All the param.* fields can be hard coded in this conf file to make the ad hoc invocation prepopulated if that's the way you want it. If you need any further help then let me know.

View solution in original post

BGrdickson
Explorer

I don't have enough Karma points to attach files so I can't show you a screenshot to what it looks like when it works unfortunately.

I can't remember exactly how I came to this conclusion but I added the following config to alert_actions.conf on my deployer and pushed to our SHC.

[snow_incident]
param._cam = {\
"category" : ["others"],\
"task" : ["others"],\
"subject" : ["others"],\
"technology" : [{"vendor":"unknown", "product":"unknown"}],\
"supports_adhoc" : true\
}
param.state = 1
param.correlation_id = $job.sid$
param.configuration_item = splunk
param.contact_type =
param.assignment_group =
param.category =
param.subcategory =
param.account = splunk_integration
param.short_description =

All the param.* fields can be hard coded in this conf file to make the ad hoc invocation prepopulated if that's the way you want it. If you need any further help then let me know.

rhirasin
Engager

Hi,

Can we do the same for BMC remedy add-on?

Does the BMC integration work as an ad hoc adaptive response?

 

0 Karma

burakatabay
Path Finder

My problem is same ? but ı use service manager.
I try this but, ı click the run adaptive response action on incident review page service manager not showing ?

0 Karma

xbp
New Member

Bump - I could use this integration as well .

Regex examples would be elite. If the strings or scripts required could be shared for service-now integration I'd be grateful.

0 Karma

BGrdickson
Explorer

I've got a solution to this now guys. I'll try and dig it out now.

0 Karma

aruneysoc
New Member

Hi ,
Can we know the solutions for this case

0 Karma

hettervik
Builder

Bump. I have the exact same problem.

0 Karma

BGrdickson
Explorer

I've got a solution to this now guys. I'll try and dig it out now.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...