All Apps and Add-ons

Duplicate Events Forwarded to Phantom

erika_horton
Explorer

We are using the Phantom Add-on to forward events from our ES SH to our Phantom instance, but after upgrading to v. 4.035 we have started getting duplicates of all events in Phantom.

The configuration was created in the Phantom Add-on UI, and is set to run every 10 minutes.

erika_horton_0-1620406046058.png

 

Labels (2)
1 Solution

erika_horton
Explorer

When setting the search schedule from the Phantom Add-on UI, it appears that Splunk defaults to doubling the search time range.
You can see this if you navigate to Searches, Reports and Alerts and look at the saved searches under the Phantom add-on.
The search will be named "_phantom_app_<configuration name>", so in this case, "_phantom_app_Crowdstrike Detection"
If you select "Edit Schedule", you can see the schedule is set to run on cron schedule with the configuration of */10 * * * *, and the Time Range is set to "Custom Time".
You can open the custom time and shrink the window here to reduce duplicated events being forwarded to Phantom.

View solution in original post

0 Karma

kprior201_lilly
Path Finder

As a heads up: they are tracking this as a bug. I had a support ticket open for the same issue after an upgrade.

0 Karma

erika_horton
Explorer

When setting the search schedule from the Phantom Add-on UI, it appears that Splunk defaults to doubling the search time range.
You can see this if you navigate to Searches, Reports and Alerts and look at the saved searches under the Phantom add-on.
The search will be named "_phantom_app_<configuration name>", so in this case, "_phantom_app_Crowdstrike Detection"
If you select "Edit Schedule", you can see the schedule is set to run on cron schedule with the configuration of */10 * * * *, and the Time Range is set to "Custom Time".
You can open the custom time and shrink the window here to reduce duplicated events being forwarded to Phantom.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!