Configuration Guide

Introduction

The Alert Manager-App's main purpose is to extend Splunk's core alerting functionality with sophisticated incident workflows and reporting.

Alert Manager can be also used to replace existing workflow solutions (eg. Incident Review in Enterprise Security).

Alert Manager core concepts

Alert Manager is built on top of Splunk's core alerting functionality, utilizing its main functionality. Instead of just doing a "fire and forget" action on the alert, Alert Manager will store the state of an alert as an incident in a KV store.

Alerts & Incidents

Incident Settings

Severity, Priority and Urgency

Auto Assignment

Auto Resolve

Alert Scripts

Categorization

Configure Alerts

Configure Incident Settings