Splunk Alert Automation

Hi Everyone,

I want to build a workflow,

Step 1 : Get alerts triggered from Splunk

Step 2 : Process the alert and take the relevant notable information.

Step 3 : Create a ticket in ITSM (Ticketing tool) with all details

Step 4 : If there is any IP run a IP reputation check.

Step 5 : Do a check about the users, alias to email conversion

Step 6 : Connect with Microsoft PowerAutomate

Step 7 : Send the information to PowerAutomate

PowerAutomate will run a flow. It will send an email with all details and an Apadtive card with option YES and NO. Also an Text input box.

If the reply is YES with input details, PowerAutomate will connect with ITSM and close the case.

If the reply is NO it will raise a child case in ITSM.

Response from user is saved in an excel in Sharepoint

Step 8 : All details with response are sent back to N8N.

Step 9 : N8N is connected with Teams channel and this details is posted.

Step 10: Workflow is closed.

Kindly help me how can i build this one. Thanks a lot

Hey,

@Jay_M Just wondering if you completed this, am implementing the log side now, either splunk or greylog, how it go?

Best regards,

Samuel