how to save adaptive response in adaptive response in incident review after correlation search is executed

[thambisetty]

Hi,
I have created correlation search and added Run a script adaptive response and notable adaptive response. I could see that notable event is created timestamp and who created notable event in adaptive response in incident review when the correlation search executed, but in the adaptive response in incident review is not showing that script has been called. I need to add one more action in adaptive response in incident review saying that script has been executed.

I am sure, someone might have already faced these kind of situation and got solution also, please share.

Thanks in advance.

[kchamplin_splun · Accepted solution]

The "Adaptive Response" section of a Notable Event is populated by some specific log output from your Adaptive Response action. If you look at the reference AR action here:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH
You will see that the CAM library sets up most of this for you, and exposes a function called "message" that is what populates that section of the notable event in the Incident Review UI.
self.message('Successfully queried for pwnage', status='success')
self.message('Failed to query for pwnage', status='failure',status_code=r.status_code)

If you want a quick way to implement these items, I would suggest using Add On Builder and porting your existing script into an AOB project.
https://splunkbase.splunk.com/app/2962/

http://dev.splunk.com/view/addon-builder/SP-CAAAFBQ