https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483137#M8623 <P>I'm new to Phantom and would like to know how I could extract data from a PDF file attached to an email. From my understanding, the workflow goes like this: email gets sent to mailbox, phantom ingests email, phantom then creates a vault artifact.</P> <P>Is it possible to:</P> <UL> <LI>get the pdf file and read it's text</LI> <LI>determine important data in the pdf such as for example, IP addresses, URLs</LI> </UL> <P>and how?</P> Sun, 07 Jun 2020 18:46:05 GMT maangellamatini 2020-06-07T18:46:05Z https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483137#M8623 <P>I'm new to Phantom and would like to know how I could extract data from a PDF file attached to an email. From my understanding, the workflow goes like this: email gets sent to mailbox, phantom ingests email, phantom then creates a vault artifact.</P> <P>Is it possible to:</P> <UL> <LI>get the pdf file and read it's text</LI> <LI>determine important data in the pdf such as for example, IP addresses, URLs</LI> </UL> <P>and how?</P> Sun, 07 Jun 2020 18:46:05 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483137#M8623 maangellamatini 2020-06-07T18:46:05Z https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483138#M8624 <P>The best way to get IOCs out of a PDF is to use the Phantom Parser App <A href="https://my.phantom.us/4.6/docs/app_reference/phantom_parser">link text</A>. </P> <P>This app will require the file to be in the vault or file location of the platform. Normally if ingesting via email, pdf attachments are automatically attached to the File/Vault location. Then you will need a vaultId from the File Artifact or Vault Artifact to send to the parser for it to extract the IOCs just like we do in emails.</P> <P>I hope this helps.</P> Thu, 14 Nov 2019 12:19:07 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483138#M8624 rgresham_splunk 2019-11-14T12:19:07Z https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483139#M8625 <P>The best way to get IOCs out of a PDF is to use the Phantom Parser App <A href="https://my.phantom.us/4.6/docs/app_reference/phantom_parser">Phantom Parser App link</A>. </P> <P>This app will require the file to be in the vault or file location of the platform. Normally if ingesting via email, pdf attachments are automatically attached to the File/Vault location. Then you will need a vaultId from the File Artifact or Vault Artifact to send to the parser for it to extract the IOCs just like we do in emails.</P> <P>I hope this helps.</P> Thu, 14 Nov 2019 12:19:25 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483139#M8625 rgresham_splunk 2019-11-14T12:19:25Z https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483140#M8626 <P>Thank you, rgresham! This was extremely helpful.</P> Fri, 15 Nov 2019 01:02:24 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-extract-data-from-PDF-file/m-p/483140#M8626 maangellamatini 2019-11-15T01:02:24Z