Splunk Enterprise Security

How to Add Workflow Search Action under notable event

gsabhay77
Explorer

From a Splunk custom App, I need to add the workflow action which should be displayed under the Actions menu for the notable event in the Incident Review view in the Splunk Enterprise Security. I have created a workflow action with 'Show Action in' attribute set to 'Event menu' and this workflow action is not visible in the notable event Actions ( in both the search and Incident Review view in the Enterprise Security ) but visible in the search view of the Splunk Enterprise.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

In ES you can setup Adaptive Response Actions that you can either make a correlation search run automatically when its triggered or ru n it your self you want.
In the Incident review dashboard got the the actions column and select "Run Adaptive Response Action"
alt text

And then select whatever action you want use. Some TAs already bring some of these actions and you can make your own.
alt text

NOTE: your workflow actions will still work on a field basis in the incident review dashboard.

More info on Adaptive Response Actions from docs:
https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Setupadaptiveresponse

More info on how to create your own Adaptive Response Action
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBF

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

gsabhay77
Explorer

Thanks for the info.. Can this be achieved using workflow actions instead of adaptive response actions as I have already have workflow action created for it. If I can only use the adaptive responsive action, can responsive action be created in the Splunk ES from a different Splunk app?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...