splunk.es.splunk_investigation_type_info module – Gather information about Splunk Enterprise Security investigation types

Note

This module is part of the splunk.es collection (version 6.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install splunk.es.

To use it in a playbook, specify: splunk.es.splunk_investigation_type_info.

New in splunk.es 5.1.0

Synopsis

  • This module allows for querying information about Splunk Enterprise Security investigation types.

  • Use this module to retrieve investigation type configurations without making changes.

  • Query by name to get a specific investigation type.

  • If name is not specified, returns all investigation types.

Note

This module has a corresponding action plugin.

Parameters

Parameter

Comments

api_app

string

The app portion of the Splunk API path for the incident types endpoint.

Override this if your environment uses a different app name.

Default: "missioncontrol"

api_namespace

string

The namespace portion of the Splunk API path.

Override this if your environment uses a different namespace.

Default: "servicesNS"

api_user

string

The user portion of the Splunk API path.

Override this if your environment requires a different user context.

Default: "nobody"

name

string

Name to filter investigation types.

Returns the investigation type with an exact name match.

If not specified, returns all investigation types.

Examples

- name: Query all investigation types
  splunk.es.splunk_investigation_type_info:
  register: all_types

- name: Query specific investigation type by name
  splunk.es.splunk_investigation_type_info:
    name: "Insider Threat"
  register: result

- name: Query investigation types with custom API path
  splunk.es.splunk_investigation_type_info:
    api_namespace: "{{ es_namespace | default('servicesNS') }}"
    api_user: "{{ es_user | default('nobody') }}"
    api_app: "{{ es_app | default('missioncontrol') }}"
  register: custom_types

- name: Get response plan IDs for an investigation type
  splunk.es.splunk_investigation_type_info:
    name: "Malware Incident"
  register: result

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

investigation_types

list / elements=dictionary

List of investigation types matching the query

Returned: always

Sample: [{"description": "Investigation type for insider threat incidents", "name": "Insider Threat", "response_plan_ids": []}, {"description": "Investigation type for malware-related incidents", "name": "Malware Incident", "response_plan_ids": ["3415de6d-cdfb-4bdb-a21d-693cde38f1e8"]}]

description

string

Description of the investigation type

Returned: success

name

string

The name of the investigation type

Returned: success

response_plan_ids

list / elements=string

List of response plan UUIDs associated with this investigation type

Returned: success

Authors

  • Ron Gershburg (@rgershbu)