Splunk Enterprise Security

How to send email from ES adaptive response action?

abi2023
Path Finder

I want to send customize email from Splunk ES  adaptive response action. How do i add custom templet for email  Message.

second can I make To and Subject dynamic for each notable. pick up from event field?

Thanks  

0 Karma
1 Solution

meetmshah
Contributor

Hello @abi2023, You will need to have the to and fields available as a part of the results and use the same fields as reference in the to / subject. Below are the detailed steps - 

  1. Configure your search query or alert to generate notable events as desired. Ensure that the notable events contain the necessary fields for the "To" and "Subject" values.

  2. In the email alert action configuration, you can use tokens to reference the event fields dynamically. Tokens are placeholders that Splunk substitutes with actual values at runtime.

  3. To reference a field in the "To" or "Subject" field, enclose the field name within double curly braces. For example, {{field_name}} represents the token for a field called "field_name".

  4. Replace the static "To" and "Subject" values in the email alert action with the appropriate tokens. For example, you can set the "To" field as {{field_name_for_to}} and the "Subject" field as {{field_name_for_subject}}.

  5. When the email alert is triggered for a notable event, Splunk will substitute the tokens with the actual values from the event fields, generating a dynamic "To" and "Subject" for each notable event.

For example - 

action.email.to = {{field_name_for_to}}
action.email.subject = {{field_name_for_subject}}

(Make sure to replace field_name_for_to and field_name_for_subject with the actual field names from your notable events.)

By using tokens, Splunk will dynamically populate the "To" and "Subject" fields for each notable event based on the event field values when the email alert is triggered.

 

Feel free to accept the answer if that helps!

View solution in original post

0 Karma

meetmshah
Contributor

Hello @abi2023, You will need to have the to and fields available as a part of the results and use the same fields as reference in the to / subject. Below are the detailed steps - 

  1. Configure your search query or alert to generate notable events as desired. Ensure that the notable events contain the necessary fields for the "To" and "Subject" values.

  2. In the email alert action configuration, you can use tokens to reference the event fields dynamically. Tokens are placeholders that Splunk substitutes with actual values at runtime.

  3. To reference a field in the "To" or "Subject" field, enclose the field name within double curly braces. For example, {{field_name}} represents the token for a field called "field_name".

  4. Replace the static "To" and "Subject" values in the email alert action with the appropriate tokens. For example, you can set the "To" field as {{field_name_for_to}} and the "Subject" field as {{field_name_for_subject}}.

  5. When the email alert is triggered for a notable event, Splunk will substitute the tokens with the actual values from the event fields, generating a dynamic "To" and "Subject" for each notable event.

For example - 

action.email.to = {{field_name_for_to}}
action.email.subject = {{field_name_for_subject}}

(Make sure to replace field_name_for_to and field_name_for_subject with the actual field names from your notable events.)

By using tokens, Splunk will dynamically populate the "To" and "Subject" fields for each notable event based on the event field values when the email alert is triggered.

 

Feel free to accept the answer if that helps!

0 Karma

javula
Loves-to-Learn Lots

@meetmshah 

I am trying to implement this solution. It doesn't work for me

When I enter To field {{src_user}} which contains the user email address, I get the error message as "There was an error saving the correlation search: One of the email addresses in 'action.email.to' is invalid

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...