Splunk Enterprise Security

Splunk Incident Review Adaptive Response not Working

burakatabay
Path Finder

Hi splunkers,
When ı research an incident and press the ESCU-Contextualize
and ESCU-Contextualize return a empty page status=failure
Why I see failure error ?

alt text

Labels (1)

andsov
Explorer

Did you ever solve this problem?

0 Karma

alonsocaio
Contributor

It looks like the search didn't find the expected data in that context. Have you checked the recommended steps? Does your Splunk data matches them?

0 Karma

burakatabay
Path Finder

Yes matches them.

0 Karma

alonsocaio
Contributor

Also, check user permissions to the resources listed in recommended steps. And if you are able, try running this adhoc search with admin user.

0 Karma

burakatabay
Path Finder

I try admin user
Result is same

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...