Splunk Enterprise Security

Palo Alto Adaptive Response from Enterprise Security

New Member



So this is the same issue I am facing which is mentioned in the above URL.

Now, I am facing the same issue even after defining the fields under "sendalert" in the "alert_actions.conf.spec" file.

Could anyone please help me with this?


"PAN : Tag to Dynamic Address Group" could not be dispatched: 
ActiveResponseException: Invalid parameter for adhoc modular action.


0 Karma

Splunk Employee
Splunk Employee

Did you specify the fields in alert_actions.conf or alert_actions.conf.spec? You'll need to specify them in alert_actions.conf.

Splunk Employee
Splunk Employee

Without knowing the contents of alert_actions.conf, we'd be unable to help you troubleshoot this further. Please provide more details about what that adaptive response action looks like in the .conf file 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!