To set up access to SOAR run actions, perform the following procedure.

Note: Some SOAR actions are available as context actions. For more information, see SOAR Actions.

Procedure

  1. Open the Splunk SOAR console.
  2. In the left navigation bar, click Sources > New Events.
  3. Select an event.
  4. Click Action, then select an action and the asset that was created during Data Ingestion configuration.

    Select an action and asset to set up access to SOAR run actions

  5. Enter the input parameters.

    For SOAR run action access, enter input parameters and click Launch

  6. Click Launch to initiate the action.