Splunk Enterprise Security

how to save adaptive response in adaptive response in incident review after correlation search is executed

thambisetty
SplunkTrust
SplunkTrust

Hi,
I have created correlation search and added Run a script adaptive response and notable adaptive response. I could see that notable event is created timestamp and who created notable event in adaptive response in incident review when the correlation search executed, but in the adaptive response in incident review is not showing that script has been called. I need to add one more action in adaptive response in incident review saying that script has been executed.

I am sure, someone might have already faced these kind of situation and got solution also, please share.

Thanks in advance.

————————————
If this helps, give a like below.
0 Karma
1 Solution

kchamplin_splun
Splunk Employee
Splunk Employee

The "Adaptive Response" section of a Notable Event is populated by some specific log output from your Adaptive Response action. If you look at the reference AR action here:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH
You will see that the CAM library sets up most of this for you, and exposes a function called "message" that is what populates that section of the notable event in the Incident Review UI.
self.message('Successfully queried for pwnage', status='success')
self.message('Failed to query for pwnage', status='failure',status_code=r.status_code)

If you want a quick way to implement these items, I would suggest using Add On Builder and porting your existing script into an AOB project.
https://splunkbase.splunk.com/app/2962/

http://dev.splunk.com/view/addon-builder/SP-CAAAFBQ

View solution in original post

kchamplin_splun
Splunk Employee
Splunk Employee

The "Adaptive Response" section of a Notable Event is populated by some specific log output from your Adaptive Response action. If you look at the reference AR action here:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH
You will see that the CAM library sets up most of this for you, and exposes a function called "message" that is what populates that section of the notable event in the Incident Review UI.
self.message('Successfully queried for pwnage', status='success')
self.message('Failed to query for pwnage', status='failure',status_code=r.status_code)

If you want a quick way to implement these items, I would suggest using Add On Builder and porting your existing script into an AOB project.
https://splunkbase.splunk.com/app/2962/

http://dev.splunk.com/view/addon-builder/SP-CAAAFBQ

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...