https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483919#M7894 <P>Thank you! So if I follow you, that's the action that occurs on the results of the savedsearch, right? Assuming I'm still with you, share with us how the search is defined?</P> Wed, 25 Sep 2019 16:30:44 GMT sloshburch 2019-09-25T16:30:44Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483916#M7891 <P>Hello,</P> <P>We're facing an issue when events are forwarded from splunk to phantom, multiple artifacts are being generated for each single event </P> <P>Noting that the configuration is done "by the book", what could be the reason behind that?</P> Thu, 19 Sep 2019 11:32:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483916#M7891 emkaxon 2019-09-19T11:32:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483917#M7892 <P>Would you clarify how you have things set up? Did you use <A href="https://splunkbase.splunk.com/app/3411">Phantom App for Splunk</A> and what <A href="https://docs.splunk.com/Documentation/PhantomApp/latest/UserGuide">event forwarding methodology</A> are you using?</P> <P>A good way to debug would be to disable all the event forwarders and turn them on one at a time to see which input (or inputs) are causing this.</P> <P>Also, share the search being used to generate the Splunk events that get sent.</P> Mon, 23 Sep 2019 16:47:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483917#M7892 sloshburch 2019-09-23T16:47:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483918#M7893 <P>We are now forwarding the events manually through the "Send to Phantom" adaptive responsive action. The event received in phantom generated 7 artifacts </P> Wed, 25 Sep 2019 11:16:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483918#M7893 emkaxon 2019-09-25T11:16:53Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483919#M7894 <P>Thank you! So if I follow you, that's the action that occurs on the results of the savedsearch, right? Assuming I'm still with you, share with us how the search is defined?</P> Wed, 25 Sep 2019 16:30:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483919#M7894 sloshburch 2019-09-25T16:30:44Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483920#M7895 <P>The search consists of scanning for an ioc from carbon black, and when detected a notable event is generated </P> Thu, 26 Sep 2019 06:05:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483920#M7895 emkaxon 2019-09-26T06:05:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483921#M7896 <P>Hey,</P> <P>The send to phantom action will extract artifacts from the splunk result for each row present. If you have multi-value fields in the result then it will extract one for each when using the "send to phantom" adaptive response action.</P> <P>Best practice is to use the event forwarding portion of the Phantom app, monitoring <CODE>notable</CODE> and configuring the mapping of cef fields to control which fields are sent to Phantom. This also doesn't create multiple artifacts, you will have one with a string of all the multi-values joined together (which could require playbook actions to separate again)</P> Mon, 07 Oct 2019 15:04:11 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/483921#M7896 WalshyB 2019-10-07T15:04:11Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/590163#M10686 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="donbinhvn_0-1647940129515.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/18674iFD66074691AE11BE/image-size/medium?v=v2&amp;px=400" role="button" title="donbinhvn_0-1647940129515.png" alt="donbinhvn_0-1647940129515.png" /></span></P><P>Look like new version of Splunk app allow us to group mv to a list.&nbsp;</P> Tue, 22 Mar 2022 09:09:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-generating-multiple-artifacts-in-phantom/m-p/590163#M10686 donbinhvn 2022-03-22T09:09:18Z