topic How to get Splunk fields as artifacts into Phantom? in Splunk SOAR

How to get Splunk fields as artifacts into Phantom?

andreasbischoff — Tue, 29 Sep 2020 22:14:19 GMT

Hi,

trying to get Palo Alto alerts for critical, high and medium threat alerts from Splunk into Phantom.

In phantom I managed to configure access to Spunk.

Query:
eventtype=pan* type=THREAT (severity=critical OR severity=high OR severity=medium)

Fields to save:
app,threat,category,dest,dest_hostname,url,log_subtype,src_user

I'm getting the events into Phantom,. but the field values are all empty?

Regards,
Andreas

Re: Getting Splunk fields as artifacts into Phantom

rgresham_splunk — Tue, 29 Sep 2020 22:14:20 GMT

Andreas,

The best practice is to use the data sources to push to Phantom verses using the app to pull. This can be configured in the Splunk Instance by following the directions seen here: https://my.phantom.us/4.1/docs/admin/splunk. You will need to install the Splunkbase Phantom App (https://splunkbase.splunk.com/app/3411/)

You can still use the app, but you must ensure that you have on_poll_query configured for 'Query to use with On Poll
and on_poll_display for Fields to save with On Poll. Empty on_poll_display will present all the available fields configured.

With that said, can you try just a basic index= search and see if that returns data?

Re: Getting Splunk fields as artifacts into Phantom

andreasbischoff — Mon, 03 Dec 2018 22:39:13 GMT

Thanks a lot.

I'll try it this way then.
It is a bit confusing, having a Splunk app for Phantom and a Phantom app for Splunk 🙂

Regards,
Andreas