Splunk generating multiple artifacts in phantom

[emkaxon]

Hello,

We're facing an issue when events are forwarded from splunk to phantom, multiple artifacts are being generated for each single event

Noting that the configuration is done "by the book", what could be the reason behind that?

[donbinhvn]

Look like new version of Splunk app allow us to group mv to a list. 

[WalshyB]

Hey,

The send to phantom action will extract artifacts from the splunk result for each row present. If you have multi-value fields in the result then it will extract one for each when using the "send to phantom" adaptive response action.

Best practice is to use the event forwarding portion of the Phantom app, monitoring notable and configuring the mapping of cef fields to control which fields are sent to Phantom. This also doesn't create multiple artifacts, you will have one with a string of all the multi-values joined together (which could require playbook actions to separate again)

[sloshburch]

Would you clarify how you have things set up? Did you use Phantom App for Splunk and what event forwarding methodology are you using?

A good way to debug would be to disable all the event forwarders and turn them on one at a time to see which input (or inputs) are causing this.

Also, share the search being used to generate the Splunk events that get sent.

[emkaxon]

We are now forwarding the events manually through the "Send to Phantom" adaptive responsive action. The event received in phantom generated 7 artifacts

[sloshburch]

Thank you! So if I follow you, that's the action that occurs on the results of the savedsearch, right? Assuming I'm still with you, share with us how the search is defined?

[emkaxon]

The search consists of scanning for an ioc from carbon black, and when detected a notable event is generated