ServiceNow Incident Integration as an alert action
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
Start by locating how detection definitions declare alert actions and how existing adaptive responses are represented. Compare that path with the snow_incident action provided by the Splunk Add-on for ServiceNow. Done means detection definitions can configure this action and the behavior is covered by the project's relevant validation or generation checks.
Written by the indexing model from the issue text.
Description
Is your feature request related to a problem? Please describe.
Yes, for an increased coverage in DaC, we need support for various Adaptive Responses (alert actions).
Describe the solution you'd like
One of the most used Adaptive Responses in ES is to create incidents in the ServiceNow platform. There is a Splunk supported TA for this, called Splunk Add-on for ServiceNow.
I'd like to have the option to configure the snow_incident alert action in my detection definitions.
Describe alternatives you've considered
Continue to use Splunk Web to configure the snow_incident adaptive response for each detection.
Additional context
Is there interest for this, so I can open a PR to propose changes?
- Dominant language
- Python
- Stars
- 139
- Forks
- 52
- Avg merge
- 1h 16m
- Merged PRs (30d)
- 3
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/contentctl
-
enhancement
Difficulty 3/5 1-2 days Newbie friendliness 45/100
splunk/contentctl#468 · 1 comment ·
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 38/100
splunk/contentctl#461 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
splunk/contentctl#452 ·
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
splunk/contentctl#464 · 3 comments ·
-
enhancement
Difficulty 3/5 1-2 days Newbie friendliness 38/100
splunk/contentctl#447 ·
All issues in splunk/contentctl
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100