Splunk Enterprise Security

Trigger an action manually

alekwisnia
Explorer

I need an action for an incident responder to send a selected event's data via email. I can define notable actions, but they will be triggered automatically when a notable is created. How can I do this manually?

Labels (2)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

One option would be to create a custom adaptive action (AR), which can be manually invoked by the responder. [ Your AR code would need to then collect the required information from the correlation search/search events and send/email as needed]

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!