All Apps and Add-ons

Phantom Addon Error: Unhashable type: 'list' when adding a server configuration

jethrop
Explorer

I am getting this error message when adding a phantom server using the new server configuration in the Phantom Add-on.

Phantom Failed to communicate with user "" on Phantom server . Error: Unhashable type: 'list'

I have managed to get the add-on working by installing a version 7 versions behind the current.

The Phantom user is setup as per documentation(and works on older version of installed app), my user has all the Phantom capabilities, and I have disabled cert validation.

I am on Splunk 8.1.2 and using the latest version of the Phantom Add-on. 

Labels (2)
Tags (1)
0 Karma

rquish
Engager

Hey @jethrop my deployment is currently running into this issue. Were you ever able to come up with or find a fix?

You said you were able to get something working by dropping back 7 versions, would that be version 2.4.18??

0 Karma

jethrop
Explorer

After filing a case the solution was to change all cef fields with * as their data types to string datatype in the app

0 Karma

ktraverse_splun
Splunk Employee
Splunk Employee

The app verifies the phantom server by making 2 REST calls to the phantom server

- /rest/cef

- /rest/cef_metadata

This error is indicating that there's a problem with the CEF field definitions, specifically the CEF fields configured in Phantom.   You can check the entire list via https://<phantom>/rest/cef/ & https://<phantom>/rest/cef_metadata.

Look for something like a null field or a list within a list (not allowed).  If you identify the problematic field, go to Admin > Admin Settings > CEF and remove the field in question and re-try the connection from the App.

List within a list Example (Bad):

"Example": {
"contains": [
["*"]
]
},

0 Karma

jethrop
Explorer

After filing a case the solution was to change all cef fields with * as their data types to string datatype in the app

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...