Splunk Enterprise Security

Splunk Enterprise Security: How to add fields to notable event after invoking adaptive response action?

splinks
Explorer

Hi,

I am wondering if it is possible to have my adaptive response actions append fields to the notable which triggered them. I am in a situation where my adaptive response action returns a link, and I would like for that link to be displayed alongside all other interesting fields in the notable.

I followed http://blogs.splunk.com/2015/04/13/how-to-edit-notable-events-in-es-programatically/ and tried to provide the REST API an argument like args['my_link'] and received the following error :

{"message":"ValueError: One of comment, owner, status, urgency is required.","success":false}

Is there anyway to update the notable and append new fields to it based on the results of adaptive response actions?

0 Karma

starcher
SplunkTrust
SplunkTrust

This may answer the question though it is not trivial.
http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/

0 Karma

apollocs
New Member

Did you ever find an answer to adding fields to "additional fields" after a notable was generated?

0 Karma

rxie_splunk
Splunk Employee
Splunk Employee

You will need to pass the argument as dictionary to the REST handler.

Try to set args['comment'] = 'my_link'

splinks
Explorer

I'm not trying to add a comment, I'm trying to add a whole new field to the notable

0 Karma

rxie_splunk
Splunk Employee
Splunk Employee

I don't think you can do it by just adding another field to the args.

Maybe just put the link in the comment field?

0 Karma

Fouad
Loves-to-Learn Lots

Did you solved your problem? Any updated? Same issue here.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...