Do you want to ingest data from a Splunk instance?
Check out the Splunk App for Phantom:
Under details, you will find a link to the documentation. It includes the chapter "Event Forwarding".
When you install this app, you will get new Phantom-related trigger actions like "Run Playbook in Phantom". This way, when a Splunk alert gets triggered, it will send the events to Phantom and run a specified playbook.
Phantom has some EDR/firewall apps that can help in polling data from the EDR/firewall sources. If it is not present, you can use API to ingest data into phantom.
To add on to this, any App in phantom that has as "on-poll" action can be configured for data ingestion on the associated type.
We also allow you to write your own apps if they aren't available out of the box.