Splunk Enterprise Security

how to save adaptive response in adaptive response in incident review after correlation search is executed

thambisetty
Super Champion

Hi,
I have created correlation search and added Run a script adaptive response and notable adaptive response. I could see that notable event is created timestamp and who created notable event in adaptive response in incident review when the correlation search executed, but in the adaptive response in incident review is not showing that script has been called. I need to add one more action in adaptive response in incident review saying that script has been executed.

I am sure, someone might have already faced these kind of situation and got solution also, please share.

Thanks in advance.

————————————
If this helps, give a like below.
0 Karma
1 Solution

kchamplin_splun
Splunk Employee
Splunk Employee

The "Adaptive Response" section of a Notable Event is populated by some specific log output from your Adaptive Response action. If you look at the reference AR action here:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH
You will see that the CAM library sets up most of this for you, and exposes a function called "message" that is what populates that section of the notable event in the Incident Review UI.
self.message('Successfully queried for pwnage', status='success')
self.message('Failed to query for pwnage', status='failure',status_code=r.status_code)

If you want a quick way to implement these items, I would suggest using Add On Builder and porting your existing script into an AOB project.
https://splunkbase.splunk.com/app/2962/

http://dev.splunk.com/view/addon-builder/SP-CAAAFBQ

View solution in original post

kchamplin_splun
Splunk Employee
Splunk Employee

The "Adaptive Response" section of a Notable Event is populated by some specific log output from your Adaptive Response action. If you look at the reference AR action here:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH
You will see that the CAM library sets up most of this for you, and exposes a function called "message" that is what populates that section of the notable event in the Incident Review UI.
self.message('Successfully queried for pwnage', status='success')
self.message('Failed to query for pwnage', status='failure',status_code=r.status_code)

If you want a quick way to implement these items, I would suggest using Add On Builder and porting your existing script into an AOB project.
https://splunkbase.splunk.com/app/2962/

http://dev.splunk.com/view/addon-builder/SP-CAAAFBQ

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!