Before
Security personnel would likely retrieve issues, open or query each issue for its associated evidence, and determine manually whether usable evidence was available. They would then copy or forward the evidence into Splunk and repeat the process as additional issues or processing cycles required.
How it works
- An emailhook starts the workflow, which evaluates its control condition and either continues the issue-processing cycle or waits 10 seconds before collecting issues.
- The workflow expands the issue list, retrieves evidence for each issue, and automatically checks whether evidence exists.
- Evidence that passes the existence check is expanded and sent to Splunk as an audit event; issues without evidence are skipped.
Workflow details
- Trigger and control flow: An emailhook event starts the workflow, which sets a control value and evaluates conditions to determine whether it should continue processing or wait 10 seconds before retrieving issues.
- Issue collection: The workflow fetches all available issues, then expands the result so each issue can be handled individually rather than as one undifferentiated response.
- Evidence retrieval: For every issue, the workflow requests the related evidence by issue ID and checks whether evidence is actually present before taking further action.
- Evidence processing: When evidence exists, the workflow expands the evidence records so they can be handled as individual data items; issues without evidence are skipped.
- Centralized delivery: Each available evidence record is sent to Splunk as an audit event, creating a consistent destination for downstream security monitoring and review.
What changed
Issue and evidence collection now runs from a single emailhook-triggered workflow, with the wait logic, record expansion, evidence validation, and Splunk handoff performed automatically. Human operators no longer need to review each issue solely to determine whether evidence should be forwarded.
Work removed
Manually retrieving issue lists, opening issues to request evidence by ID, checking whether evidence exists, expanding records for processing, copying evidence into Splunk, and repeating the collection cycle.
Expected outcome
At least one manual issue-to-Splunk collection cycle is removed per workflow run, with evidence availability checked automatically before ingestion.
