Hello,
A question about "Example adaptive response action" given in dev.splunk.com/view/enterprise-security/SP-CAAAFBH.
How does it handle more than one result?
When this adaptive response action(ARA) is added to (handling) a correlation search, users can put in mappings. For example, user can enter
description: $result.user$
Then result.user will be mapped to the configuration of this ARA. For example, if result.user is "user1", then in the dowork method of the ARA, if we look at self.configuration["description"], we will get "user1". This is good.
However what happens if ARA needs to handle more than one result? For example, the first result has result.user="user1" and the second result has result.user="user2". Now self.configuration["description"] in dowork method always shows "user2". This mapping is only good for the second result.
How shall we handle the first result then? We don't have the mapping information (description:$result.user$) entered by the user. The self.configuration contains the already substituted/mapped configuration for the second result. How can we figure out that description for the first result shall be "user1" here then?
Thank you very much for your help.
