Update Splunk notables from Splunk Soar

Splunk Enterprise

Hi Team,

is it possible to update/enrich a notable after executing a playbook in splunk soar and that execution output must be attached in the Splunk notable.

Example:

Assume I have correlation search named one and this triggers a notable and run a playbook actions. Now once the search triggers and notable is created, the action run a playbook should execute in soar and attach that output to the notable created.

You think of this attaching ip reputation/geo locations of an ip to the notable so that soc can work without logging into virus total or any other sites.

Thank you

Get Updates on the Splunk Community!

Update Splunk notables from Splunk Soar

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Join the Conversation

Update Splunk notables from Splunk Soar

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform