splunk-security_content/package/default/workflow_actions.conf

[workbench_panel_aws_investigate_user_activities_by_arn]]
label                   = Workbench - AWS Investigate User Activities By ARN
type                    = link
fields                  = *user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_arn&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_investigate_user_activities_by_accesskeyid]]
label                   = Workbench - AWS Investigate User Activities By AccessKeyId
type                    = link
fields                  = *accessKeyId*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_accesskeyid&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_investigate_user_activities_by_source_user]]
label                   = Workbench - AWS Investigate User Activities By Source User
type                    = link
fields                  = *src_user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_investigate_user_activities_by_source_user&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_network_acl_details_from_id]]
label                   = Workbench - AWS Network ACL Details from ID
type                    = link
fields                  = *networkAclId*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_acl_details_from_id&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_network_interface_details_via_resourceid]]
label                   = Workbench - AWS Network Interface details via resourceId
type                    = link
fields                  = *resourceId*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_network_interface_details_via_resourceid&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_aws_s3_bucket_details_via_bucketname]]
label                   = Workbench - AWS S3 Bucket details via bucketName
type                    = link
fields                  = *bucketName*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_aws_s3_bucket_details_via_bucketname&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_all_backup_logs_for_host]]
label                   = Workbench - All backup logs for host
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_all_backup_logs_for_host&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_amazon_eks_kubernetes_activity_by_src_ip]]
label                   = Workbench - Amazon EKS Kubernetes activity by src ip
type                    = link
fields                  = *src_ip*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_amazon_eks_kubernetes_activity_by_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_gcp_kubernetes_activity_by_src_ip]]
label                   = Workbench - GCP Kubernetes activity by src ip
type                    = link
fields                  = *src_user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_gcp_kubernetes_activity_by_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_city]]
label                   = Workbench - Get All AWS Activity From City
type                    = link
fields                  = *City*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_city&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_country]]
label                   = Workbench - Get All AWS Activity From Country
type                    = link
fields                  = *Country*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_country&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_ip_address]]
label                   = Workbench - Get All AWS Activity From IP Address
type                    = link
fields                  = *src_ip*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_ip_address&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_all_aws_activity_from_region]]
label                   = Workbench - Get All AWS Activity From Region
type                    = link
fields                  = *Region*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_all_aws_activity_from_region&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_authentication_logs_for_endpoint]]
label                   = Workbench - Get Authentication Logs For Endpoint
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_authentication_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_backup_logs_for_endpoint]]
label                   = Workbench - Get Backup Logs For Endpoint
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_backup_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_certificate_logs_for_a_domain]]
label                   = Workbench - Get Certificate logs for a domain
type                    = link
fields                  = *domain*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_certificate_logs_for_a_domain&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_dns_server_history_for_a_host]]
label                   = Workbench - Get DNS Server History for a host
type                    = link
fields                  = *src_ip*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_dns_server_history_for_a_host&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get


[workbench_panel_get_ec2_instance_details_by_instanceid]]
label                   = Workbench - Get EC2 Instance Details by instanceId
type                    = link
fields                  = *instanceId*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_instance_details_by_instanceid&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_ec2_launch_details]]
label                   = Workbench - Get EC2 Launch Details
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_ec2_launch_details&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_email_info]]
label                   = Workbench - Get Email Info
type                    = link
fields                  = *message_id*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_email_info&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_emails_from_specific_sender]]
label                   = Workbench - Get Emails From Specific Sender
type                    = link
fields                  = *src_user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_emails_from_specific_sender&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address]]
label                   = Workbench - Get First Occurrence and Last Occurrence of a MAC Address
type                    = link
fields                  = *src_mac*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_history_of_email_sources]]
label                   = Workbench - Get History Of Email Sources
type                    = link
fields                  = *src*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_history_of_email_sources&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_logon_rights_modifications_for_endpoint]]
label                   = Workbench - Get Logon Rights Modifications For Endpoint
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_logon_rights_modifications_for_user]]
label                   = Workbench - Get Logon Rights Modifications For User
type                    = link
fields                  = *user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_logon_rights_modifications_for_user&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_notable_history]]
label                   = Workbench - Get Notable History
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_notable_history&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_notable_info]]
label                   = Workbench - Get Notable Info
type                    = link
fields                  = *event_id*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_notable_info&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get







[workbench_panel_get_process_responsible_for_the_dns_traffic]]
label                   = Workbench - Get Process Responsible For The DNS Traffic
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_process_responsible_for_the_dns_traffic&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_registry_activities]]
label                   = Workbench - Get Registry Activities
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_registry_activities&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_risk_modifiers_for_endpoint]]
label                   = Workbench - Get Risk Modifiers For Endpoint
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_risk_modifiers_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_risk_modifiers_for_user]]
label                   = Workbench - Get Risk Modifiers For User
type                    = link
fields                  = *user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_risk_modifiers_for_user&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get


[workbench_panel_get_update_logs_for_endpoint]]
label                   = Workbench - Get Update Logs For Endpoint
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_update_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_user_information_from_identity_table]]
label                   = Workbench - Get User Information from Identity Table
type                    = link
fields                  = *user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_get_user_information_from_identity_table&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_vulnerability_logs_for_endpoint]]
label                   = Workbench - Get Vulnerability Logs For Endpoint
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_vulnerability_logs_for_endpoint&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_get_web_session_information_via_session_id]]
label                   = Workbench - Get Web Session Information via session id
type                    = link
fields                  = *session_id*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_get_web_session_information_via_session_id&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_aws_ecr_container_listing_activity]]
label                   = Workbench - Investigate AWS ECR container listing activity
type                    = link
fields                  = *Compute.event_name*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_ecr_container_listing_activity&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_aws_user_activities_by_user_field]]
label                   = Workbench - Investigate AWS User Activities by user field
type                    = link
fields                  = *user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_aws_user_activities_by_user_field&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_aws_activities_via_region_name]]
label                   = Workbench - Investigate AWS activities via region name
type                    = link
fields                  = *awsRegion*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_aws_activities_via_region_name&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_cloud_compute_instance_activities]]
label                   = Workbench - Investigate Cloud Compute Instance Activities
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_cloud_compute_instance_activities&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_failed_logins_for_multiple_destinations]]
label                   = Workbench - Investigate Failed Logins for Multiple Destinations
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_failed_logins_for_multiple_destinations&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_network_traffic_from_src_ip]]
label                   = Workbench - Investigate Network Traffic From src ip
type                    = link
fields                  = *src_ip*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_network_traffic_from_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_okta_activity_by_ip_address]]
label                   = Workbench - Investigate Okta Activity by IP Address
type                    = link
fields                  = *user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_ip_address&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_okta_activity_by_app]]
label                   = Workbench - Investigate Okta Activity by app
type                    = link
fields                  = *app*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_okta_activity_by_app&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_pass_the_hash_attempts]]
label                   = Workbench - Investigate Pass the Hash Attempts
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_hash_attempts&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_pass_the_ticket_attempts]]
label                   = Workbench - Investigate Pass the Ticket Attempts
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_pass_the_ticket_attempts&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_previous_unseen_user]]
label                   = Workbench - Investigate Previous Unseen User
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_previous_unseen_user&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_successful_remote_desktop_authentications]]
label                   = Workbench - Investigate Successful Remote Desktop Authentications
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_successful_remote_desktop_authentications&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get



[workbench_panel_investigate_user_activities_in_okta]]
label                   = Workbench - Investigate User Activities In Okta
type                    = link
fields                  = *user*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_identity=$@field_value$&panel=workbench_panel_investigate_user_activities_in_okta&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get


[workbench_panel_investigate_web_activity_from_host]]
label                   = Workbench - Investigate Web Activity From Host
type                    = link
fields                  = *dest*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_activity_from_host&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_web_activity_from_src_ip]]
label                   = Workbench - Investigate Web Activity From src ip
type                    = link
fields                  = *src_ip*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_activity_from_src_ip&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_investigate_web_posts_from_src]]
label                   = Workbench - Investigate Web POSTs From src
type                    = link
fields                  = *src*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_investigate_web_posts_from_src&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get

[workbench_panel_process_chain_analysis]]
label                   = Workbench - Process Chain Analysis
type                    = link
fields                  = *process_guid*
display_location        = field_menu
link.uri                = /app/$@namespace$/ess_workbench_panel?type_asset=$@field_value$&panel=workbench_panel_process_chain_analysis&drilldown_field=$@field_name$&use_drilldown_time=true
link.target             = blank
link.method             = get