I am implementing a custom Modular Alert Action in Splunk 10.x, but the action does not appear in the Add Actions dropdown menu of the alerts, even though we have checked the syntax and the main logs. All files are correctly located within the n8n_integration app, ...\n8n_integration\default\alert_actions.conf --> file alert_actions.conf ...\n8n_integration\bin\payload_attack_force_brute_n8n.py --> script ...\n8n_integration\data\ui\alerts\payload_attack_force_brute_n8n.html --> UI Contents of alert_actions.conf [payload_attack_force_brute_n8n] label = Enviar Alerta N8N description = Envia payload JSON de alerta de Fuerza Bruta a n8n is_custom = 1 payload_format = json python.version = python3 icon_path = n8n_integration/static/brute-force-attack-icon.png Diagnosis Performed and Discarded I checked the python.log after reboot and when loading the alert page. There are no FATAL/ERROR errors related to the loading of the modular action script. The stanza ([payload_attack_force_brute_n8n]) exactly matches the .py and .html file names. Any suggestions on where to look for a silent loading error or if there is a missing syntax in the stanza would be greatly appreciated.
... View more