Splunk SOAR

Prompt email with certain event

johnlee2327
Explorer

I have try to prompt with my email.

To execute the requested action, deny or delegate, click here https://10.250.74.118:8443/approval/14.

It need to enter the WEB UI and found the "certain" prompt.
If I have 10000 prompt, I can not found the event related to the email rapidly.

johnlee2327_0-1724123070546.png
 If it is possible that use rest api to post prompt decision to soar certain event?

Labels (1)
0 Karma
1 Solution

SOARt_of_Lost
Path Finder

If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.

To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.  That would look something like

https://10.250.74.118:8443/mission/[number]/analyst/approvals 

 

View solution in original post

0 Karma

SOARt_of_Lost
Path Finder

If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.

To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.  That would look something like

https://10.250.74.118:8443/mission/[number]/analyst/approvals 

 

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...