Update Device Policy using Splunk SIEM

The Update Device Policy Alert Action updates the policy associated with the specified device. Example: Move a device to a more restrictive policy during incident investigation.

Note: See also Devices API.

Configuration:

Device ID Field

The field name in the search results that contains the Device ID to update.

Policy ID Field

The field name in the search results that contains the new policy ID to apply.