Update or edit an event in Splunk SOAR (On-premises)

You can edit or set several attributes of an event, also called a container, using the /set command.

You can set or edit these attributes:

  • name
  • label
  • owner_id
  • status
  • severity
  • sensitivity

Use the following format to set an attribute: 

/set <attribute> <value>

You can use datapaths to set attributes for multiple events at a time. See Use a datapath in Splunk SOAR (On-premises).

Examples

Rename a container 

/set <current name> <new name>

Set the severity of an event 

/set severity high

Set the status of an event 

/set status open