How can I set up an email alert to notify someone who is assigned the incident from the incident review page?
have a look at below thread
https://community.splunk.com/t5/Splunk-Enterprise-Security/KV-Store-Lookup-to-Email-with-timestamp-s...
View solution in original post