When constructing the post data from a Notable Event in Enterprise Security Incident Review dashboard as an event action, the $rule_title$ field is sent through with unexpanded tokens such as "$signature$ - IDS watchlist event for $src$" instead of the actual title. If instead I perform the same Workflow action from the results of a search for the notable event in the format " notable_by_id(xxx) |expandtoken" then the value is passed through as desired. So I can achieve what I want I suppose with two Workflow actions: first a search, then a POST link, but that seems silly. Is there any way to get the POST link action to expand the tokens from the dashboard without having to open the notable in a new search and pipe it to the expandtoken command?
... View more
