Getting Data In

Data Ingestion into Phantom


How do i ingest data into Splunk Phantom ?

Tags (2)
0 Karma


Phantom has some EDR/firewall apps that can help in polling data from the EDR/firewall sources. If it is not present, you can use API to ingest data into phantom.

0 Karma

Splunk Employee
Splunk Employee

To add on to this, any App in phantom that has as "on-poll" action can be configured for data ingestion on the associated type.

We also allow you to write your own apps if they aren't available out of the box.

0 Karma


Do you want to ingest data from a Splunk instance?

Check out the Splunk App for Phantom:

Under details, you will find a link to the documentation. It includes the chapter "Event Forwarding".

When you install this app, you will get new Phantom-related trigger actions like "Run Playbook in Phantom". This way, when a Splunk alert gets triggered, it will send the events to Phantom and run a specified playbook.

0 Karma


I want to ingest data from other sources like a firewall or an EDR solution , is there is way to directly add data sources?

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...