Closed Tyrell20 closed 1 year ago
Good afternoon, It will be very good indeed to do so and I know that the App Builder is integrating this feature I think but I don’t have any licence to check this with Splunk ES ... (not a personal one and my company doesn’t have it yet) Do you know if we can a demo version ? Thank you
Hi @LetMeR00t I think no. It could be very useful try to integrate these specs inside the TA. It will increase the efficiency to manage event from ES in TheHive.
Hi @Tyrell20, @remg427 will take a look at this. We keep you in touch
Hello, thank you for your feature request. I would like to clarify with you what you ask for. My understanding is that you would like to configure a CS with several actions such as
If correct, then the issue is that actions are launched without interacting so action notable does not provide back event_id AFAIK so I have a different approach CS ==> notable and then another saved search index=notable ==> TheHive - Create a new alert this way in second step I can get event_id and send it to TheHive
Hello, many thanks for your interesting about this feature request. I try to report with more detail the desiderata. In Splunk ES the Notable Event are managed under Incident Review's dashboard. Here the analyst have the list of notable event reported by Urgency. Every Notable Event shows the information below:
So, starting from this perspective the feature's request would to configure the TA adding to the current options:
If something should be not clear please ask.
Many thanks for your support.
Hi, A new proposal on the dev branch was provided partially or totally for this issue. Could you take a look at this and give us some feedback if this is resolved your issue ? Thank you
Hi, Many thanks for your interest and work. Unfortunately I do not have a test version of SplunkES, so I would like to understand better, before testing the dev version, how it interacts with Splunk and if it includes some of the suggested integrations.
Many thanks
Hi @Tyrell20 , I close this issue as it's a duplicate of #16. As mentionned in the same issue, I have now access to a Splunk ES instance and I'll try to assess what it's the error if it's still not working. Thank you
Request Type
Feature Request
Work Environment
Problem Description
Enhance the integration between TheHive and Splunk Enterprise Security enriching alerts on TheHive with the "Originating Event" from correlation search and with the information about the related "Urgency". Allow to close Splunk ES Notable Event with the closing of TheHive's case.
Steps to Reproduce
Possible Solutions
Configuring the TA in order to recover the metadata about the Splunk ES CS and sent them to TheHive.