Splunk Enterprise Security

how to create incident from an triggered alert

avni26
Explorer

Hi,

I'm trying to create a alert action to create a incident when any alert gets triggered.
Whats the best way to achieve it,Please suggest.

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

To create incident in ServiceNow from Splunk:

Step 1: Install Splunk Add-on for ServiceNow: https://splunkbase.splunk.com/app/1928/

Step2: Setup add-on by following steps here: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on#Set_up_using_Splunk_...

Step 3: Create incidents using custom alert action: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions#ServiceNow_In...

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

To create incident in ServiceNow from Splunk:

Step 1: Install Splunk Add-on for ServiceNow: https://splunkbase.splunk.com/app/1928/

Step2: Setup add-on by following steps here: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on#Set_up_using_Splunk_...

Step 3: Create incidents using custom alert action: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions#ServiceNow_In...

0 Karma

cduffey_splunk
Splunk Employee
Splunk Employee

Is there a specific system you are wanting to create in (e.g. ServiceNow), or is it a customer system?

0 Karma

avni26
Explorer

@cduffey yes, for ServiceNow system.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...