topic Re: "Cannot connect to WebSocket" - Phantom OVA 4.5 in Splunk SOAR

"Cannot connect to WebSocket" - Phantom OVA 4.5

shivinder — Sun, 07 Jun 2020 17:40:16 GMT

I am facing an issue where I continually keep getting a little pop-up at the top right hand side of the Phantom webpage which says - "Cannot connect to WebSocket" (Screenshot attached with this message)

I downloaded the latest OVA v4.5.15922 from my.phantom.us and imported this appliance to VirtualBox. No custom configurations at all. The host operating system is MacOS 10.14.6.

Is it happening because I am missing some setting? Any help would be appreciated.

Thanks!

Re: "Cannot connect to WebSocket" - Phantom OVA 4.5

sam_splunk — Tue, 13 Aug 2019 15:43:27 GMT

Can you describe how you have your network set-up in virtualbox?

Re: "Cannot connect to WebSocket" - Phantom OVA 4.5

shivinder — Wed, 14 Aug 2019 08:09:35 GMT

Hi,

Thank you for replying to my question. To answer you, I did not change any settings in the default Splunk Phantom OVA image in the first place. Here is the screenshot of the settings from the image file.

https://shavi-test-bucket-01.s3-ap-southeast-2.amazonaws.com/Screen+Shot+2019-08-14+at+17.57.07.png

I did have some custom subnets configured for my VirtualBox. But I had disabled them. This is the screenshot of the settings here, if it helps.

https://shavi-test-bucket-01.s3-ap-southeast-2.amazonaws.com/Screen+Shot+2019-08-14+at+18.02.34.png

Thanks!

Re: "Cannot connect to WebSocket" - Phantom OVA 4.5

shivinder — Wed, 14 Aug 2019 08:19:17 GMT

For some reason my previous comment seems to have lost. I am writing it again. Sorry about that.

I did not change any settings in the Splunk Phantom OVA. Here is the screenshot of the settings dialog - https://shavi-test-bucket-01.s3-ap-southeast-2.amazonaws.com/Screen+Shot+2019-08-14+at+17.57.07.png

I did have some custom settings to my VirtualBox software. But they were disabled. Here is the screenshot of the VirtualBox settings - https://shavi-test-bucket-01.s3-ap-southeast-2.amazonaws.com/Screen+Shot+2019-08-14+at+18.02.34.png

I hope it helps.

Cheers!
Shivinder.

Re: "Cannot connect to WebSocket" - Phantom OVA 4.5

sam_splunk — Wed, 14 Aug 2019 14:35:51 GMT

No problem. However when trying to view the screenshots, AWS is requiring some authorization. Error: Requests specifying Server Side Encryption with AWS KMS managed keys require AWS Signature Version 4.

Re: "Cannot connect to WebSocket" - Phantom OVA 4.5

shivinder — Fri, 16 Aug 2019 04:56:11 GMT

Sorry, my bad. Fixed it.

Re: "Cannot connect to WebSocket" - Phantom OVA 4.5

sam_splunk — Thu, 22 Aug 2019 03:56:16 GMT

Hi Shivinder, I am having trouble duplicating this behavior. I've got virtual box set up the same as your screenshots with no problem.

Could you switch your virtualbox configuration to Host-Only adapter and see if the problem persists? I'm wondering if there is a physical-link issue and we can rule that out this way.