How can I write my own adaptive response action?

[smoir_splunk]

I want to build an adaptive response action to push malware signatures from Enterprise Security into my own application and return data about them to ES using a REST API. What is the best way to get started? Are there any examples?

[rpille_splunk · Accepted solution]

Yes, we have documentation and examples that walk through building a custom adaptive response action.

Follow this documentation for step-by-step instructions: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF

You'll notice there are two paths available to you:
1. Use Splunk Add-on Builder, which simplifies the process considerably. See this example: http://dev.splunk.com/view/addon-builder/SP-CAAAFBQ
2. Create the action manually. See this example: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH

If you want to use Splunk Add-on Builder, download it here: https://splunkbase.splunk.com/app/2962/