Getting Data In

My Playbook cannot be find in Alerts dashboard

dadataz
Explorer

Hello,

I'm on Splunk 7.3.3

with the "Security Monitoring for Splunk" https://splunkbase.splunk.com/app/4131

I have install all the addons.

I have create a Playbook Entries, but when i try to find it in the dashboard "Alerts" where you can find all your schedule alerts, i only have my personnal rules, rules from this app but not my new rules.
I notice on the playbook the owner is admin and the others pre-rules are Monitoring App.

Any idea why i can't find my rule ? I cannot configure the workflow in this case.

Best regards

0 Karma

dadataz
Explorer

I check the "Searches, Reports, and Alerts" for the "App: Security Monitoring for Splunk (security_monitoring_for_splunk)"
I find the default rule for exemple : "5001-INV-Incorrectly_Routed_DNS_Traffic" when you click on edit just show Edit permission, Edit Alert Disable, Advanced Edit and Clone.
Instead the rules i have create have : edit Search, Edit Permissions, Edit Schedule, Edit Acceleration, Edit Summary Indexing, Disable, Advanced Edit, clone, embed, move and Delete.

0 Karma

dadataz
Explorer

I just saw this is creating a report, not an alert.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...