Is there a way to send all matching notable events to a custom index with very vague fields?

[sm1tty]

Is there a way to send all matching notable events to a custom index with very vague fields (due to confidentiality reasons)?

I would like to send event data to a new index that basically says "You have a new alert" so that I can integrate it with an XSOAR solution without disclosing any confidential information. This is due to the way the ingestion script is written - anyone can modify the query to pull information from the logs. 

The intention is to notify analysts that an alert is present without (potentially) exposing this information to unauthorized individuals.

[smurf]

Hi,

you could add "Log Event" Adaptive response action to your correlation search, or create a new search that would match notables and the action would be "Log Event". You can specify index, sourcetype, source and host as well as message of the event.