Splunk Enterprise Security

Splunk generating multiple artifacts in phantom

emkaxon
New Member

Hello,

We're facing an issue when events are forwarded from splunk to phantom, multiple artifacts are being generated for each single event

Noting that the configuration is done "by the book", what could be the reason behind that?

0 Karma

WalshyB
Path Finder

Hey,

The send to phantom action will extract artifacts from the splunk result for each row present. If you have multi-value fields in the result then it will extract one for each when using the "send to phantom" adaptive response action.

Best practice is to use the event forwarding portion of the Phantom app, monitoring notable and configuring the mapping of cef fields to control which fields are sent to Phantom. This also doesn't create multiple artifacts, you will have one with a string of all the multi-values joined together (which could require playbook actions to separate again)

0 Karma

sloshburch
Ultra Champion

Would you clarify how you have things set up? Did you use Phantom App for Splunk and what event forwarding methodology are you using?

A good way to debug would be to disable all the event forwarders and turn them on one at a time to see which input (or inputs) are causing this.

Also, share the search being used to generate the Splunk events that get sent.

0 Karma

emkaxon
New Member

We are now forwarding the events manually through the "Send to Phantom" adaptive responsive action. The event received in phantom generated 7 artifacts

0 Karma

sloshburch
Ultra Champion

Thank you! So if I follow you, that's the action that occurs on the results of the savedsearch, right? Assuming I'm still with you, share with us how the search is defined?

0 Karma

emkaxon
New Member

The search consists of scanning for an ioc from carbon black, and when detected a notable event is generated

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!