To set up access to SOAR context actions, perform the following procedure.

Note: Some SOAR actions are available as context actions. For more information, see SOAR Actions.

Procedure

  1. Open the Splunk SOAR console.
  2. In the left navigation bar, click Sources > New Events.
  3. Select an event.
  4. Go to the Artifacts section and extend the view by clicking the arrows.
  5. Select a parameter and click the arrow next to its value.
  6. Click the Run Action tab and select an action.

    Run context action

  7. Enter the input parameters.

    For SOAR run action access, enter input parameters and click Launch

  8. Click Launch to initiate the action.