Splunk Enterprise Security

I want to send the event_id of the notable event to jira service desk.

linearity_abcd
Loves-to-Learn Lots

Hello

I am trying to send the notable event to jira service desk

Data fields such as rule name are transmitted normally.

But the event_id field appears blank.

Without event_id, I can't come back to a notable event. Then no further analysis, such as investigation

How can I add an event_id or link related to the notable event in jira's ticket?

Thank you.

Labels (1)
0 Karma

alexeyglukhov
Path Finder

hi, did you end up with something viable ?

thanks

0 Karma

linearity_abcd
Loves-to-Learn Lots

Hello,

 

I’m not sure how it works in the latest version of the add-on,

but at that time, it was correct that the event_id was not passed.

 

I wrote my query by referring to the notable macro.

By generating the event_id using eval and passing it as a custom field,

it was possible to send it over.

 

Thank you.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...