Splunk Enterprise Security

How to send email from ES adaptive response action?

abi2023
Path Finder

I want to send customize email from Splunk ES  adaptive response action. How do i add custom templet for email  Message.

second can I make To and Subject dynamic for each notable. pick up from event field?

Thanks  

0 Karma
1 Solution

meetmshah
Builder

Hello @abi2023, You will need to have the to and fields available as a part of the results and use the same fields as reference in the to / subject. Below are the detailed steps - 

  1. Configure your search query or alert to generate notable events as desired. Ensure that the notable events contain the necessary fields for the "To" and "Subject" values.

  2. In the email alert action configuration, you can use tokens to reference the event fields dynamically. Tokens are placeholders that Splunk substitutes with actual values at runtime.

  3. To reference a field in the "To" or "Subject" field, enclose the field name within double curly braces. For example, {{field_name}} represents the token for a field called "field_name".

  4. Replace the static "To" and "Subject" values in the email alert action with the appropriate tokens. For example, you can set the "To" field as {{field_name_for_to}} and the "Subject" field as {{field_name_for_subject}}.

  5. When the email alert is triggered for a notable event, Splunk will substitute the tokens with the actual values from the event fields, generating a dynamic "To" and "Subject" for each notable event.

For example - 

action.email.to = {{field_name_for_to}}
action.email.subject = {{field_name_for_subject}}

(Make sure to replace field_name_for_to and field_name_for_subject with the actual field names from your notable events.)

By using tokens, Splunk will dynamically populate the "To" and "Subject" fields for each notable event based on the event field values when the email alert is triggered.

 

Feel free to accept the answer if that helps!

View solution in original post

0 Karma

meetmshah
Builder

Hello @abi2023, You will need to have the to and fields available as a part of the results and use the same fields as reference in the to / subject. Below are the detailed steps - 

  1. Configure your search query or alert to generate notable events as desired. Ensure that the notable events contain the necessary fields for the "To" and "Subject" values.

  2. In the email alert action configuration, you can use tokens to reference the event fields dynamically. Tokens are placeholders that Splunk substitutes with actual values at runtime.

  3. To reference a field in the "To" or "Subject" field, enclose the field name within double curly braces. For example, {{field_name}} represents the token for a field called "field_name".

  4. Replace the static "To" and "Subject" values in the email alert action with the appropriate tokens. For example, you can set the "To" field as {{field_name_for_to}} and the "Subject" field as {{field_name_for_subject}}.

  5. When the email alert is triggered for a notable event, Splunk will substitute the tokens with the actual values from the event fields, generating a dynamic "To" and "Subject" for each notable event.

For example - 

action.email.to = {{field_name_for_to}}
action.email.subject = {{field_name_for_subject}}

(Make sure to replace field_name_for_to and field_name_for_subject with the actual field names from your notable events.)

By using tokens, Splunk will dynamically populate the "To" and "Subject" fields for each notable event based on the event field values when the email alert is triggered.

 

Feel free to accept the answer if that helps!

0 Karma

javula
Loves-to-Learn Lots

@meetmshah 

I am trying to implement this solution. It doesn't work for me

When I enter To field {{src_user}} which contains the user email address, I get the error message as "There was an error saving the correlation search: One of the email addresses in 'action.email.to' is invalid

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...