Splunk Enterprise Security

Splunk ES - Adaptive Response - Send Email per Result of Correlation Search


Hey Team,

Wanted to be able to send an email as an Adaptive Response for a correlation search per result. Just like a notable event is created per-event, is there a way to configure the "Send Email" to be sent per-event, based on information in the notable event?

For example, if a correlation search has 5 hits, 5 notable events are created. Let's say there are 5 different email addresses on these 5 events; is it possible to use "$result.email$" to alter who get the email per event?

I know a limitation or the design of $result.email$ is just to take the first row, but was thinking when used in conjunction with Correlation search, there might be a way to utilize the Adaptive Response per event.

Thoughts? Any additional data needed? Thanks all!


Lets say you have a field called myemail_addr in each of the 5 events, resulting from your correlation search, you can use that as a token $myemail_address$ in the email adaptive response to send different email to each of the 5 users. would this help?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...