topic Re: invalid token error while communicating through rest API with phantom using splunk in Splunk SOAR

invalid token error while communicating through rest API with phantom using splunk

rajafarhat16 — Sun, 07 Jun 2020 17:17:30 GMT

Re: invalid token error while communicating through rest API with phantom using splunk

rajafarhat16 — Mon, 06 Jan 2020 05:37:41 GMT

can anyone here to help me in this regard ?

Re: invalid token error while communicating through rest API with phantom using splunk

sam_splunk — Mon, 06 Jan 2020 16:42:58 GMT

Can you provide more details on what configuration you have set on both sides? Also have you checked out: https://my.phantom.us/4.5/docs/admin/splunk ?

Re: invalid token error while communicating through rest API with phantom using splunk

rajafarhat16 — Tue, 07 Jan 2020 06:33:36 GMT

thanks i solved my issue

Re: invalid token error while communicating through rest API with phantom using splunk

sam_splunk — Tue, 07 Jan 2020 15:13:32 GMT

Would you be able to post the details of your fix in case anyone else runs across the same problem?

Re: invalid token error while communicating through rest API with phantom using splunk

cblumer_splunk — Tue, 07 Jan 2020 18:56:38 GMT

Areas to check:

Automation user on the Phantom side used for the Splunk integration - check the "Allowed IPs" config, this needs to allow for the Splunk search head to communicate with the Phantom host to create new containers/artifacts via the Forwarding Config
Make sure you're entering the entire 'ph-auth-token' value on the Phantom Server Configuration
Check the $splunk_home/var/log/splunk/phantom_configuration.log file for more details

Please post more information to aid in finding a fix.

Re: invalid token error while communicating through rest API with phantom using splunk

Crypt — Wed, 02 Dec 2020 03:44:08 GMT

Not OP but my issue was that I'd allowed the wrong IP address. I'd discounted this as a possibility but when I checked the logs on the Phantom server (/var/log/nginx/access.log) I found that the IP of my Splunk server was not what I'd expected (vitulisation messiness).

Thanks to the others in this thread.