Hello @lpoko, You can use "/services/notable_update"  from here - for most tasks https://docs.splunk.com/Documentation/ES/latest/API/NotableEventAPIreference   Please accept the solution if this helps! ... View more