Splunk SOAR

Prompt email with certain event

johnlee2327
Explorer

I have try to prompt with my email.

To execute the requested action, deny or delegate, click here https://10.250.74.118:8443/approval/14.

It need to enter the WEB UI and found the "certain" prompt.
If I have 10000 prompt, I can not found the event related to the email rapidly.

johnlee2327_0-1724123070546.png
 If it is possible that use rest api to post prompt decision to soar certain event?

Labels (1)
0 Karma
1 Solution

SOARt_of_Lost
Path Finder

If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.

To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.  That would look something like

https://10.250.74.118:8443/mission/[number]/analyst/approvals 

 

View solution in original post

0 Karma

SOARt_of_Lost
Path Finder

If you have more than a small number of prompts at a time, you need to change how your playbooks are working. Speaking from experience, that will lead to things being missed and waiting for too long.

To answer your question, you could try changing your link to point at the container holding the prompt instead of the prompt on its own.  That would look something like

https://10.250.74.118:8443/mission/[number]/analyst/approvals 

 

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...