Splunk Enterprise Security

I want to send the event_id of the notable event to jira service desk.

linearity_abcd
Loves-to-Learn Lots

Hello

I am trying to send the notable event to jira service desk

Data fields such as rule name are transmitted normally.

But the event_id field appears blank.

Without event_id, I can't come back to a notable event. Then no further analysis, such as investigation

How can I add an event_id or link related to the notable event in jira's ticket?

Thank you.

Labels (1)
0 Karma

alexeyglukhov
Path Finder

hi, did you end up with something viable ?

thanks

0 Karma

linearity_abcd
Loves-to-Learn Lots

Hello,

 

I’m not sure how it works in the latest version of the add-on,

but at that time, it was correct that the event_id was not passed.

 

I wrote my query by referring to the notable macro.

By generating the event_id using eval and passing it as a custom field,

it was possible to send it over.

 

Thank you.

 

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...