Reporting

Correlation search email response action, edited message not being sent.

justinw
Explorer

I found that someone else had asked this, but as it was asked in 2015, I thought I would ask as well.

Correlation searches contain many different "Adaptive Response Actions", one such action is the "Send email" action. This action contains multiple fields to be filled in such as: To, Priority, Subject, Message, Include, and Type. The "Message" field will come pre filled. The "Message" field will display in the body of an email when triggered.
Now the problem is that even if you were to change the "Message", the body of the email that is actually sent will not update. Splunk does save the new Message, so what you wrote will not be deleted, but it will not send with the email, as it does with Alerts.
The reason this is an issue for me, is because I am trying to make getting to a search based off of info from the event easier. I planned on including something that would refer to the results and add it as a link in the email, ie
https://splunksite.com/app/search/search?something | where $result.count$>x

If there is another way to make this work aside from making an alert out of the correlation search and using an alert action, please let me know. I do not want to be running two searches for the exact same thing just so one can email correctly while the other makes Notable Events correctly.

Thank you.

0 Karma

jawaharas
Motivator

From your question, if I am not wrong -
you are saying that body of email is not getting updated when you add both 1) notable and 2) send email options under 'Adaptive Response Actions' in a correlation search.

The issue is not replicable in Enterprise Security Suite version 5.3.0. What's your ESS version?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...