About Alerting Actions and the Adaptive Response Framework
This section describes how Alerting Actions and the Adaptive Response Framework work with the Illumio App for Splunk. This section covers features where the Splunk App takes action by invoking update APIs on the Illumio PCE.
There are two types of quarantine provided by Illumio:
A custom alert action provided for Splunk Enterprise, also called Splunk Core, the base Splunk product. See Using custom alert actions in the Splunk documentation.
An adaptive response action provided for Splunk Enterprise Security (ES), which is different from the Splunk core product. See Create an adaptive response action in the Splunk documentation.
The Splunk core already provides standard alert actions such as sending emails, notable events, and calling a Webhook URL. Modular actions on top of standard alert actions are nothing but custom alert actions. These custom alert actions let you invoke Python scripts that use APIs external to Splunk.
The Enterprise Security Suite app provides support for Correlation/Saved Searches with notable actions. When a Splunk Enterprise Security Correlation/Saved Search (with a notable event mapped) is executed and gets at least one event in the results, notable events will be created through a standard notable action. These notable events are visible in the Incident Review dashboard of the Splunk Enterprise Security App. No other alert action (other than the notable action) is executed automatically, because none are mapped.
Splunk provides the Adaptive Response Framework in the Enterprise Security Suite by leveraging the modular action functionality provided in Splunk_SA_CIM.
Using Splunk Enterprise Security’s Adaptive Response Framework, Illumio PCE administrators can quarantine workloads managed by the PCE directly from Splunk Apps whenever the events are detected in Splunk, based on data sent by any source of alerts in Enterprise Security.
There are two ways to invoke actions on the workloads:
Quarantine workloads using Splunk Core Alert Actions.
Quarantine workloads using Splunk Enterprise Security Suite’s Adaptive Response Framework.