Enter the API endpoint, example: /services/trackme/v2/splk_dsm/ds_disable_data_sampling
https://trackme.readthedocs.io/en/latest/rest_api_reference.html
HTTP mode expected by the API endpoint
HTTP body if expected by the endpoint (json). Example: {"object": "$result.object$"} You can define it in SPL within the alert and reference the field such as: $result.action_body$