https://community.splunk.com/t5/Splunk-SOAR/Splunk-Phantom/m-p/516981#M456 <P>Phantom is mainly used to automate&nbsp;<SPAN>repetitive tasks.</SPAN></P><P><SPAN>for example: if you have correlation search in Splunk that alerts when phishing email is found.</SPAN></P><P><SPAN>in general scenarios, analyst will follow incident playbook to perform actions in response to phishing alert.</SPAN></P><P><SPAN>The list of actions purely based on how incident can be properly handled, below are the just examples:</SPAN></P><UL><LI>identifying list of recipients who received phishing email</LI><LI>identifying list of users who clicked on phishing link using proxy logs</LI><LI>notifying users that they received phishing email with subject "what ever it is"</LI><LI>changing password of users&nbsp;</LI><LI>sharing of new passwords to the users.</LI></UL><P>and also, find more use case here&nbsp;</P><P><A href="https://www.splunk.com/en_us/blog/security/playbooks-going-beyond-incident-response-use-cases.html" target="_blank">https://www.splunk.com/en_us/blog/security/playbooks-going-beyond-incident-response-use-cases.html</A></P><UL><LI>&nbsp;</LI></UL> Mon, 31 Aug 2020 09:18:51 GMT thambisetty 2020-08-31T09:18:51Z https://community.splunk.com/t5/Splunk-SOAR/Splunk-Phantom/m-p/516969#M455 <P>Can one use Splunk phantom for auto-remediation?</P><P>What real-life use cases are applicable to the use of Phantom?</P><P>&nbsp;</P> Mon, 31 Aug 2020 08:14:46 GMT https://community.splunk.com/t5/Splunk-SOAR/Splunk-Phantom/m-p/516969#M455 rhugo 2020-08-31T08:14:46Z https://community.splunk.com/t5/Splunk-SOAR/Splunk-Phantom/m-p/516981#M456 <P>Phantom is mainly used to automate&nbsp;<SPAN>repetitive tasks.</SPAN></P><P><SPAN>for example: if you have correlation search in Splunk that alerts when phishing email is found.</SPAN></P><P><SPAN>in general scenarios, analyst will follow incident playbook to perform actions in response to phishing alert.</SPAN></P><P><SPAN>The list of actions purely based on how incident can be properly handled, below are the just examples:</SPAN></P><UL><LI>identifying list of recipients who received phishing email</LI><LI>identifying list of users who clicked on phishing link using proxy logs</LI><LI>notifying users that they received phishing email with subject "what ever it is"</LI><LI>changing password of users&nbsp;</LI><LI>sharing of new passwords to the users.</LI></UL><P>and also, find more use case here&nbsp;</P><P><A href="https://www.splunk.com/en_us/blog/security/playbooks-going-beyond-incident-response-use-cases.html" target="_blank">https://www.splunk.com/en_us/blog/security/playbooks-going-beyond-incident-response-use-cases.html</A></P><UL><LI>&nbsp;</LI></UL> Mon, 31 Aug 2020 09:18:51 GMT https://community.splunk.com/t5/Splunk-SOAR/Splunk-Phantom/m-p/516981#M456 thambisetty 2020-08-31T09:18:51Z