Splunk Enterprise Security

How to create tickets to an external ticketing system for incidents from Incident Review of Splunk Enterprise Security

ben2abraham
New Member

Team,

I know how to create tickets to an external ticketing system for single rules, but in Enterprise Security, it is difficult to go to all rules and modify output actions to run a script for creating tickets. Is there any way that I can follow so that I can see all the incidents in my external ticketing system at the same time when an incident is triggered in Incident view panel of Enterprise security rather than modifying rules one by one?

Regards,
Ben

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

@ben2abraham, you've probably solved this by now but all notable events that appear on the incident review dashboard populate a notable index that you could then read to send over to the ticketing system, rather than modifying the searches that create the notable events.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...