ES - Why Adaptive Response Actions in rules are unassigned by default

Available Languages

Updated:September 29, 2026
Document ID:SPLK048765

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Security (ES) Splunk Security Content (ESCU) Splunk Security Essentials (SSE)

Description

While editing the Correlation Search on the ES Content Management Page, there are no pre-assigned actions found in the Adaptive Response Section.
To validate:
  1. Navigate to Enterprise Security App
  2. Under Configure dropdown choose Content and then navigate to Content Management
  3. Edit the Rule from the below mentioned list and scroll down to find the Adaptive Response Action as shown below. 
image.png
The following Rules are used for detecting suspicious activities, tracking console logins, and identifying security breaches, etc;

Rules from Enterprise Security Content Update (ESCU)
ESCU - 7zip CommandLine To SMB Share Path - Rule
ESCU - AWS CreateAccessKey - Rule
ESCU - AWS IAM Delete Policy - Rule
ESCU - AWS IAM Successful Group Deletion - Rule
ESCU - Detect AWS Console Login by New User - Rule
ESCU - Detect AWS Console Login by User from New City - Rule
ESCU - Detect AWS Console Login by User from New Country - Rule
ESCU - Detect AWS Console Login by User from New Region - Rule
ESCU - Detect Computer Changed with Anonymous Account - Rule

Rules from Splunk Security Essentials (SSE):
AWS APIs Called More Often Than Usual Per Account
AWS Cloud Provisioning Activity from Unusual Country

Investigation

Rules does not have any Adaptive Response actions assigned by default.

Found some information from Security Content in Splunk Documentation and Detection Types on Github.



 

Resolution

The searches above mentioned are classified as Hunting searches.

A detection that increases the risk of an asset or entity, although tends to be too noisy to generate a notable event by itself. It leverages aggregated risk from various other detections to produce a notable. Also known as hunting queries.

These searches are designed for on-the-spot usage and do not have associated Adaptive Response (AR) actions by default. It is generally up to the user to decide the usage and its associated actions for those searches.

The Hunting Analytic Type in ESCU is designed for proactive threat detection. It doesn't generate immediate alerts but helps identify anomalies that might evade standard detection methods. It's tied to a dashboard for visualization, doesn't trigger automated responses, and isn't enabled by default. It operates on an ongoing basis rather than a set schedule and focuses on empowering security teams to investigate potential threats in-depth


Github: Detection Analytic Types
Splunk Docs: Security Content
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Articles