Forward Events into Phantom

[mripp]

I am currently using Splunk Enterprise 8.0.3 and Phantom version 4.8.24304. All Phantom apps have been installed and are configured correctly.

In Splunk Web, I have successfully configured the Phantom Server in the App, and applied the Splunk Enterprise instance IP under the "allowed ips" in Phantom.

I have tried two ways of forwarding data into Phantom from Splunk; through the event forwarding of saved searches and through the HTTP Event Collector (HEC). Splunk Web and Phantom are on two different VM, I am not able to connect utilizing the HEC in Phantom under the Search Settings option, and the saved search for event forwarding never appears in Phantom.

For the HEC, I used the following URL: hxxp://splunk_host:8088/services/collector/event .  Each time whether using http or https, the request 404's out.

The saved search function allows me to choose to "Send to Phantom", but again I am not seeing any events in Phantom.  I have verified connectivity between the VM's and there are no issues there. The problem lies somewhere with my HEC and the saved searches for forwarding.

My VM is listening on port 8088 for HEC.

Any help would be greatly appreciated.

[smcclory]

Hello @mripp ,

The "Send to Phantom" only works with with Enterprise Security currently.
We have to use the script phantom_forward.py even though scripts are deprecated. $SPLUNK_HOME/etc/apps/phantom/bin/scripts/phantom_forward.py is the location of the script.
You should be able to see it if you select the alert option for a script while in the Splunk Add-on for Phantom app.

Our problem is currently with the phantom.conf replication causing Splunk SH Clustering issues when a real-time search is running. It replicates across the cluster so often that it causes baseline and snapshot replication problems.