Is there a way to ingest data via an email response?

[nick405060]

Hi there,

We send out alerts via Splunk about potential phishing attacks. We'd like to have users mark the alerts after they have received and investigated them - e.g. label them as investigated, false positive, true positive, etc. Is there a way for users to label the alert directly in the email? (e.g., using voting buttons to send a response back to Splunk where the metrics are aggregated, or by having the users respond to the email)

I could create a dashboard showing all the alerts, with textboxes to enter the labels/data, but I'd like to hear ideas on a more elegant (preferably email or Slack-based) solution

[richgalloway]

@nick405060 Is your problem resolved? If so, please accept an answer.

[bean545]

Thanks for the information.

[jkat54 · Accepted solution]

You could build this yourself and put links in the emails that link back to api endpoints.

You’d need some unique identifier generated for each alert so you could reference the Id when your users “vote”.

Imagine a link in email like this:

<a href=“https://localhost:8089/.../yourApp/handler/_update?uniqueId=$idField$&status=closed”>Close this</a>

See https://docs.splunk.com/Documentation/Splunk/7.2.3/AdvancedDev/CustomAlertScript for details on the alert action portion

[nick405060]

Thanks!! This definitely seems like the best option so far. A little above my skill level, but I can take a crack at it

[jkat54]

There’s more than a handful of partners that do this sort of development. If it’s a high stakes use case, you might consider hiring outside help.

By the way, all this was once above everyone else’s skill level too. You got what it takes to learn splunk development ;-). Just have patience!

[jkat54]

Did you build this out?

[nick405060]

Had to put it off a bit due to the amount of time it's going to take. On my radar for the next 4-5 weeks

[jkat54]

Cool, come see us in #app-dev on slack when you’re ready!

[valiquet]

We have that but it's not recommended. SMTP is unreliable protocol.

[sdchakraborty]

Hello,

Please take a look at the below app. Not sure fully whether this will resolve your query. Very interesting use case.

https://splunkbase.splunk.com/app/1739/

Sid