Update Splunk notables from Splunk Soar

Splunk Enterprise

Hi Team,

is it possible to update/enrich a notable after executing a playbook in splunk soar and that execution output must be attached in the Splunk notable.

Example:

Assume I have correlation search named one and this triggers a notable and run a playbook actions. Now once the search triggers and notable is created, the action run a playbook should execute in soar and attach that output to the notable created.

You think of this attaching ip reputation/geo locations of an ip to the notable so that soc can work without logging into virus total or any other sites.

Thank you

Get Updates on the Splunk Community!

Update Splunk notables from Splunk Soar

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue

Request for Professional Development: Attending .conf26

Join the Conversation

Update Splunk notables from Splunk Soar

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue

Request for Professional Development: Attending .conf26