Splunk Enterprise Security

how to create incident from an triggered alert

avni26
Explorer

Hi,

I'm trying to create a alert action to create a incident when any alert gets triggered.
Whats the best way to achieve it,Please suggest.

0 Karma
1 Solution

manjunathmeti
Champion

To create incident in ServiceNow from Splunk:

Step 1: Install Splunk Add-on for ServiceNow: https://splunkbase.splunk.com/app/1928/

Step2: Setup add-on by following steps here: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on#Set_up_using_Splunk_...

Step 3: Create incidents using custom alert action: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions#ServiceNow_In...

View solution in original post

0 Karma

manjunathmeti
Champion

To create incident in ServiceNow from Splunk:

Step 1: Install Splunk Add-on for ServiceNow: https://splunkbase.splunk.com/app/1928/

Step2: Setup add-on by following steps here: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on#Set_up_using_Splunk_...

Step 3: Create incidents using custom alert action: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions#ServiceNow_In...

View solution in original post

0 Karma

cduffey_splunk
Splunk Employee
Splunk Employee

Is there a specific system you are wanting to create in (e.g. ServiceNow), or is it a customer system?

0 Karma

avni26
Explorer

@cduffey yes, for ServiceNow system.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!