Overview

Details

Datapunctum Alert Manager Enterprise helps IT Ops and Security teams manage their alerts within Splunk Enterprise and Splunk Cloud.

Add the Alert Manager Enterprise Alert Action to your existing searches and manage your alerts immediately.

Note: This app replaces the legacy Alert Manager App (https://splunkbase.splunk.com/app/2665)

What is Alert Manager Enterprise?

Datapunctum Alert Manager Enterprise helps IT Ops and Security teams manage their alerts within Splunk Enterprise and Splunk Cloud.

Add the Alert Manager Enterprise Alert Action to your existing searches and manage your alerts immediately.

Why Alert Manager Enterprise

We know that investigating and analyzing Alerts without switching tools speeds up root cause analyzing and security investigations tremendously. AME is the solution to go from alerts to actionable insights.

With AME, you can move beyond simple fire-and-forget email alerting. The integrated notification schemes allow sending the right information to the right person through the right channel.

AME provides role-based access control to your managed events. For service providers, multi-tenancy can handle all tenants from one front end without compromising security.

The in-built Security Knowledge Pack containing the Cyber Kill Chain, Mitre Att&ack, NIST and CVE Framework helps Security specialists to classify events quickly.

Businesses using Alert Manager Enterprise see results quickly due to easy deployment/configuration and operations.

Explore Alert Manager Enterprise Features

Intuitive User Interface
Notification Schemes ( Mail, Slack, Webhooks, Alert Actions)
Rule Engine to automatically update events
Workflow Action to trigger GET/POST-Requests and Searches
Alert Aggregation to combine repeating alerts
Role-Based Access Control
Multi-Tenancy (subscription required)
Custom Statuses and Resolutions
Security Knowledge Pack for Cyber Kill Chain, Mitre Att&ck, NIST Framework and CVE (subscription required)
Service Level Agreement Management (subscription required)

Release Notes

Version 3.4.0

May 8, 2025

What's New
Release Notes

Important
Please read the Before Upgrading

Version 3.4.0

What's new:

Ticketing Integration with ServiceNow
AME-1088 Allow assignee filtering for current user
AME-1085 New event summary action for updating events
AME-1084 New event summary action to comment events
AME-919 Add observable and risk data to notification context
AME-850 Display User's Full Name in History and Comments
AME-787 Support for single tenant licensing

Fixed issues:

AME-1054 Typo in ame_events_overview
AME-1043 Observable tab, selected but not present fields can not be deselected

Version 3.3.2

April 10, 2025

What's New
Release Notes

Important
Please read the Before Upgrading

Version 3.3.2

Fixed issues:

AME-1045 ResizeObserver loop Notifications Appearing when resizing or zooming into the browser window
AME-1046 Alert time in E-Mail Template is in epoch
AME-1050 Ensure that Upgrade Tasks working with KV-Wrappers directly don't try to work with soft-deleted elements

Version 3.3.1

March 27, 2025

What's New
Release Notes

Important
Please read the Before Upgrading

Version 3.3.1

Fixed issues:

AME-979 Observable transforms and automatic lookups should be shared instance wide
AME-994 Manually activate/resolve SLA dialog does not auto-close after action
AME-1010 ResizeObserver loop Notifications Appearing when resizing or zooming into the browser window
AME-1021 Workflow actions eventKey / tenantUid error
AME-1026 Empty action.correlationsearch.annotations crashes alert action
AME-1029 Fieldsets are not populated for newly created tenants
AME-1030 Observables Ingest fails with: Entry with key {not_stored} does not exist.
AME-1032 Matching error for rules

Version 3.3.0

March 11, 2025

What's New
Release Notes

Important
Please read the Before Upgrading

Version 3.3.0

What's new:

AME-825 Add event retention
AME-825 Support for additional CA Certificates
AME-829 Add backup and restore functionality for configurations
AME-834 Make action buttons customizable
AME-853 Filter Functionality Enhancements - Persist Filter selection values after clicking Apply
AME-854 Filter Functionality Enhancements - Display the name of the actively selected filter
AME-870 Create tenant index audit entries on notification sent
AME-957 Implement implicit OR-matching in rules
AME-916 Add more external links in navigation

Fixed issues:

AME-867 Do not enumerate disabled Workflow Actions
AME-881 Update rules applied on already updated event payload
AME-899 Store EventCreateTrigger with resulting event after creation rules

Version 3.2.3

Jan. 15, 2025

What's New
Release Notes

Important
Please read the Before Upgrading

Version 3.2.3

What's new:

AME-724 Clonable Fieldsets
AME-832 Tooltips on comment page

Fixed issues:

AME-823 Submit button should be disabled for status, resolution, assignee modal when no change
AME-824 Event Resolution change should only show applicable resolutions for current status
AME-826 Add _cam and _cam_workers to AlertQueueOriginalSearch or allow extra arguments
AME-831 Use secondary sort field for consistent sorting results
AME-833 Extended view does not break on width
AME-849 Show assignee display name missing on assignee hover

Version 3.1.3

Oct. 17, 2024

What's New
Release Notes

Important
Please read the [Before Upgrading](https://docs.datapunctum.com/ame/ame-before-upgrading

Fixed issues:

AME-780 Bulk update does not chunk existing query
AME-781 Bulk update modal should only allow save if something is updated

Version 3.0.8

July 1, 2024

What's New
Release Notes

Important
Please read the [Before Upgrading](https://docs.datapunctum.com/ame/ame-before-upgrading

Fixed issues:
- AME-605 Notification-Templates: TextArea and better access to alert data
- AME-609 Correct ame_server log level
- AME-610 Inconsistent Event state after updating event via REST
- AME-613 Action-Notification: allow empty structured templates
- AME-614 Migration tags are not handled the same for event and tag creation
- AME-615 Add count=0 to user list in user tenant mapping to fetch all users

8,040

Downloads

Share Subscribe

Version

Built by

Datapunctum AG

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

App Contents: Inputs, Alert Actions

Compatibility

This version of the app (3.1.3) is not available for Splunk Cloud. However, version 3.2.3 of this app is available for Splunk Cloud.

This version of the app (3.0.8) is not available for Splunk Cloud. However, version 3.2.3 of this app is available for Splunk Cloud.

Products: Splunk Enterprise, Splunk Cloud

Products: Splunk Enterprise

Splunk Versions: 10.0, 9.4, 9.3, 9.2, 9.1