Splunk Enterprise Security

Why aren't Enterprise Security Webhooks and PagerDuty in the dropdown in ES Adaptive Response?

tonymorin
Explorer

Not sure why I see all my alert option in searching and reporting, but when I look in enterprise security web hooks and pager duty are not in the drop-down. I have checked the action permissions and they are global, and I and 100 admin of the system. not sure if its ES or what... I feel like I should see at least the web hooks option in ES? Thanks in advance.
alt text

0 Karma
1 Solution

tonymorin
Explorer

Found the answer for ES at least.
Found the fix. We had to add the pager duty the follow string: to the app imports update
([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(SecKit_[DST]A_.*)|(alert_governance)|(SA-org_custom_content)|(utbox)|(pagerduty_incidents)
Now its an alert option in ES as wel and works FYI.

View solution in original post

0 Karma

tonymorin
Explorer

Found the answer for ES at least.
Found the fix. We had to add the pager duty the follow string: to the app imports update
([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(SecKit_[DST]A_.*)|(alert_governance)|(SA-org_custom_content)|(utbox)|(pagerduty_incidents)
Now its an alert option in ES as wel and works FYI.

0 Karma

zschmerber
Explorer

Where is the " to the app imports update" is that a .conf or .py file somewhere in Splunk or the TA?

I want to know where to paste the string:

([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(SecKit_[DST]A_.*)|(alert_governance)|(SA-org_custom_content)|(utbox)|(pagerduty_incidents)

Thanks for your help.

0 Karma

zschmerber
Explorer
0 Karma

fandharper
Engager

I had the same issue. Here's what I did to do to make it work:

  1. Changed the name of the app to TA-slack_alerts (probably not necessary)
  2. Added empty tags.conf and eventtypes.conf files to TA-slack_alerts/default
  3. Modified slack.html to use an input instead of a text area due to getting an error stating that there was no message specified even though there was. This was in TA-slack_alerts/default/data/ui/alerts

Now it shows up and I'm successfully able to have it send me alerts when my correlation searches fire.

Hope this helps,

-Dan

starcher
SplunkTrust
SplunkTrust

The slack app was updated this week to use the naming convention TA- and AR support.

kchamplin_splun
Splunk Employee
Splunk Employee
0 Karma

starcher
SplunkTrust
SplunkTrust

Just because something is coded as an alert action does not mean the developer made them into ES compatible Adaptive Responses. There is extra setup for that. My expectation is those are not built to be explicitly adaptive responses for ES.

kchamplin_splun
Splunk Employee
Splunk Employee

@Starcher is correct - the ES import fix will allow it to show up as an alert option in the correlation search builder, but there's underlying functionality that will not work (such as UI updates, etc). There's a canonical example for how to implement an AR action:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH

Note that eventtypes and tags are an important part for the drilldown capability to work, and you also need to implement the action as a subclass of a ModularAction, so things like the logging format, and other class methods (addevent and writeevents) are used.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...