Closed bil15 closed 1 year ago
Hi why unique id is not suitable here? If a field is computed to have unique value per row it will be sliced
On the other hand I will have a look on how notable event works -- Sent with K-9 Mail.
@remg427 As for me, it's not suitable because I need to configure all actions for my 3 splunkes manually (I'm doing it using script, I mean adding "send to thehive" action). Then, as far as I understand, "reference" field in my thehive will contain, for exapmle, source IP for this alert and all concept of alert having unique ID will fail.
btw I thing it's cool idea to make alert sending concept as much similar to notable events in ES as possible, regardless of my opinion and issues I currently have
Hi Ok would it be OK to add a switch in alert conf to keep current behaviour or split each row in an alert with a unique alert id regardless of reference field -- Sent with K-9 Mail.
Couldn't ask for more I think it's a great idea Will wait for this feature in upcoming release Wish you the best!
Can I let you work en this @remg427 ?
Hi, I could work on it in coming days if OK for you
Le 10 avril 2021 05:54:02 GMT+02:00, LmR @.***> a écrit :
Can I let you work en this @remg427 ?
-- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: https://github.com/LetMeR00t/TA-thehive-cortex/issues/24#issuecomment-817072815
-- Sent with K-9 Mail.
Yes it’s okay for me as I don’t have a Splunk ES licence unfortunately :)
Hi, A new proposal on the dev branch was provided partially or totally for this issue. Could you take a look at this and give us some feedback if this is resolved your issue ? Thank you
Request Type Feature Request
Work Environment
Feature Description To slice correlation row by row for alert creation like ES does. For example, my correlation search returns a table of 3 rows, one of which is field names, and I want to have them as separate alerts in TheHive, like Enterprise Security does. Unique ID usage is not suitable here for me.
Possible Solutions