Splunk SOAR (f.k.a. Phantom)

AWS Guardduty App S3 Details Issue

splkphntmuser
New Member

The AWS Gaurdduty app from Splunk is not pulling in S3 details, when they normally are included in Gaurdduty alerts.

Normally, there would be a section for S3 details, when it is a part of an AWS Gaurdduty finding. AWS documentation can be seen here: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings-summary.html.

Wanted to see if anyone else is experiencing this same issue. This occurs with on-poll/ingestion or if using the action to go get the findings.

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...