Splunk Enterprise Security

Why aren't Enterprise Security Webhooks and PagerDuty in the dropdown in ES Adaptive Response?

tonymorin
Explorer

Not sure why I see all my alert option in searching and reporting, but when I look in enterprise security web hooks and pager duty are not in the drop-down. I have checked the action permissions and they are global, and I and 100 admin of the system. not sure if its ES or what... I feel like I should see at least the web hooks option in ES? Thanks in advance.
alt text

0 Karma
1 Solution

tonymorin
Explorer

Found the answer for ES at least.
Found the fix. We had to add the pager duty the follow string: to the app imports update
([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(SecKit_[DST]A_.*)|(alert_governance)|(SA-org_custom_content)|(utbox)|(pagerduty_incidents)
Now its an alert option in ES as wel and works FYI.

View solution in original post

0 Karma

tonymorin
Explorer

Found the answer for ES at least.
Found the fix. We had to add the pager duty the follow string: to the app imports update
([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(SecKit_[DST]A_.*)|(alert_governance)|(SA-org_custom_content)|(utbox)|(pagerduty_incidents)
Now its an alert option in ES as wel and works FYI.

0 Karma

zschmerber
Explorer

Where is the " to the app imports update" is that a .conf or .py file somewhere in Splunk or the TA?

I want to know where to paste the string:

([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(SecKit_[DST]A_.*)|(alert_governance)|(SA-org_custom_content)|(utbox)|(pagerduty_incidents)

Thanks for your help.

0 Karma

zschmerber
Explorer
0 Karma

fandharper
Engager

I had the same issue. Here's what I did to do to make it work:

  1. Changed the name of the app to TA-slack_alerts (probably not necessary)
  2. Added empty tags.conf and eventtypes.conf files to TA-slack_alerts/default
  3. Modified slack.html to use an input instead of a text area due to getting an error stating that there was no message specified even though there was. This was in TA-slack_alerts/default/data/ui/alerts

Now it shows up and I'm successfully able to have it send me alerts when my correlation searches fire.

Hope this helps,

-Dan

starcher
SplunkTrust
SplunkTrust

The slack app was updated this week to use the naming convention TA- and AR support.

kchamplin_splun
Splunk Employee
Splunk Employee
0 Karma

edavson_splunk
Splunk Employee
Splunk Employee
0 Karma

starcher
SplunkTrust
SplunkTrust

Just because something is coded as an alert action does not mean the developer made them into ES compatible Adaptive Responses. There is extra setup for that. My expectation is those are not built to be explicitly adaptive responses for ES.

kchamplin_splun
Splunk Employee
Splunk Employee

@Starcher is correct - the ES import fix will allow it to show up as an alert option in the correlation search builder, but there's underlying functionality that will not work (such as UI updates, etc). There's a canonical example for how to implement an AR action:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH

Note that eventtypes and tags are an important part for the drilldown capability to work, and you also need to implement the action as a subclass of a ModularAction, so things like the logging format, and other class methods (addevent and writeevents) are used.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...