Splunk SOAR

Prompt email with certain event

johnlee2327
Explorer

I have try to prompt with my email.

To execute the requested action, deny or delegate, click here https://10.250.74.118:8443/approval/14.

It need to enter the WEB UI and found the "certain" prompt.
If I have 10000 prompt, I can not found the event related to the email rapidly.

johnlee2327_0-1724123070546.png
 If it is possible that use rest api to post prompt decision to soar certain event?

Labels (1)
0 Karma
1 Solution

SOARt_of_Lost
Path Finder

If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.

To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.  That would look something like

https://10.250.74.118:8443/mission/[number]/analyst/approvals 

 

View solution in original post

0 Karma

SOARt_of_Lost
Path Finder

If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.

To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.  That would look something like

https://10.250.74.118:8443/mission/[number]/analyst/approvals 

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...