Splunk Enterprise Security

Using tokens within tokens in Notable Events

hunterar
Engager

I have created a workflow action to send a Notable Event to ServiceNow to create an incident. I am unable to figure out how to resolve nested tokens. For example, if the rule title for the correlation rule is "Host With A Recurring Malware Infection ($signature$ On $dest$)"  and I use:

`notable` 
| search event_hash=$event_hash$ 
| eval comments="$rule_title$"
| snowincidentalert

what ends up in ServiceNow is "Host With A Recurring Malware Infection ($signature$ On $dest$)". The signature and dest tokens do not get expanded.  How can I tell it to recursively expand any tokens nested inside other tokens?

 

Labels (1)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

@hunterar 

try below : you are looking for command "expandtoken" will expand tokens.

`notable` 
| expandtoken
| search event_hash=$event_hash$ 
| eval comments="$rule_title$"
| snowincidentalert

  

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

@hunterar 

try below : you are looking for command "expandtoken" will expand tokens.

`notable` 
| expandtoken
| search event_hash=$event_hash$ 
| eval comments="$rule_title$"
| snowincidentalert

  

————————————
If this helps, give a like below.

hunterar
Engager

Thanks, that fixed it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...