adaptive response action

adaptive response action

noun

A type of custom alert action that conforms to the common action model. In Splunk Enterprise Security, you can trigger Adaptive Response actions from correlation searches or on an ad hoc basis when examining a notable event on Incident Review. You can create a custom Adaptive Response action with the Splunk Add-on Builder or by leveraging the cim_actions.py library available in the Common Information Model Add-on.

For more information

In Administer Splunk Enterprise Security:

• Set up Adaptive Response actions in Splunk Enterprise Security

On the Splunk Developer Portal:

• Create an Adaptive Response action

In the Splunk Add-on Builder User Guide:

• Create an Adaptive Response action for Enterprise Security

In the Common Information Model Add-on Manual:

• Use the common action model to build custom alert actions