Splunk Enterprise Security

Palo Alto Adaptive Response from Enterprise Security

New Member



So this is the same issue I am facing which is mentioned in the above URL.

Now, I am facing the same issue even after defining the fields under "sendalert" in the "alert_actions.conf.spec" file.

Could anyone please help me with this?


"PAN : Tag to Dynamic Address Group" could not be dispatched: 
ActiveResponseException: Invalid parameter for adhoc modular action.


0 Karma

Splunk Employee
Splunk Employee

Did you specify the fields in alert_actions.conf or alert_actions.conf.spec? You'll need to specify them in alert_actions.conf.

Splunk Employee
Splunk Employee

Without knowing the contents of alert_actions.conf, we'd be unable to help you troubleshoot this further. Please provide more details about what that adaptive response action looks like in the .conf file 🙂

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...