Hello,

I am running into an issue with passing the rule_title value from Splunk to Resilient. Normally the rule_title is pulled from the notable event, however I am adding a dynamic field to the notable event (within Splunk) which comes over to resilient as "searchCommand". 

For example the rule_title for the notable event would be: Threat - Malicious Download - test.exe

where test.exe is being dynamically populated through the notable event action with the below syntax:
Threat - Malicious Download - $file_name$.

In resilient this looks like: Threat - Malicious Download - searchCommand

Is there any way to pass the rule_title from a notable event to resilient with a dynamic value/field?

------------------------------
Alexander Lombardi
------------------------------

Hello Alexander,

Thanks for contacting us about our product.

As far as I can tell, the "alert action token" substitution is handled by Splunk. This Splunk document lists out all the tokens: https://docs.splunk.com/Documentation/Splunk/7.3.1/AdvancedDev/ModAlertsLog
$file_name$ is not a token listed in the above document. So the substitution might not be well-defined.

Do you actually want $result.file_name"?

Thanks,

Yongjian

------------------------------
Yongjian Feng
------------------------------