Splunk Enterprise Security
Highlighted

how to create incident from an triggered alert

Explorer

Hi,

I'm trying to create a alert action to create a incident when any alert gets triggered.
Whats the best way to achieve it,Please suggest.

0 Karma
Highlighted

Re: how to create incident from an triggered alert

Splunk Employee
Splunk Employee

Is there a specific system you are wanting to create in (e.g. ServiceNow), or is it a customer system?

0 Karma
Highlighted

Re: how to create incident from an triggered alert

Explorer

@cduffey yes, for ServiceNow system.

0 Karma
Highlighted

Re: how to create incident from an triggered alert

Influencer

To create incident in ServiceNow from Splunk:

Step 1: Install Splunk Add-on for ServiceNow: https://splunkbase.splunk.com/app/1928/

Step2: Setup add-on by following steps here: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Setuptheadd-on#Set_up_using_Splunk_...

Step 3: Create incidents using custom alert action: https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Usecustomalertactions#ServiceNow_In...

View solution in original post

0 Karma