Splunk Enterprise Security

How to Add Workflow Search Action under notable event

gsabhay77
Explorer

From a Splunk custom App, I need to add the workflow action which should be displayed under the Actions menu for the notable event in the Incident Review view in the Splunk Enterprise Security. I have created a workflow action with 'Show Action in' attribute set to 'Event menu' and this workflow action is not visible in the notable event Actions ( in both the search and Incident Review view in the Enterprise Security ) but visible in the search view of the Splunk Enterprise.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

In ES you can setup Adaptive Response Actions that you can either make a correlation search run automatically when its triggered or ru n it your self you want.
In the Incident review dashboard got the the actions column and select "Run Adaptive Response Action"
alt text

And then select whatever action you want use. Some TAs already bring some of these actions and you can make your own.
alt text

NOTE: your workflow actions will still work on a field basis in the incident review dashboard.

More info on Adaptive Response Actions from docs:
https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Setupadaptiveresponse

More info on how to create your own Adaptive Response Action
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

gsabhay77
Explorer

Thanks for the info.. Can this be achieved using workflow actions instead of adaptive response actions as I have already have workflow action created for it. If I can only use the adaptive responsive action, can responsive action be created in the Splunk ES from a different Splunk app?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...