Splunk SOAR (f.k.a. Phantom)

Phantom System Health Check

rsantoso_splunk
Splunk Employee
Splunk Employee

Would like to ask on how can we determine if the System Health being shown is still within threshold and will not affect the Phantom performance.

How can we determine if we have good or bad thresholds in our System Health and if we need to do changes in our server set-up or troubleshoot running processes?

Eg. If Memory Usage of the system and the processes are still OK.

Labels (2)
Tags (2)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

The system health here is basically the reflection of the phantom instance OS Memory, Load average and Disk Usage. Also the utilisation of the memory and CPU of the processes. There is no threshold where it is impacting phantom performance as long as the resource still available. The utilisation can be more than 90% and Phantom still working fine because the resources are still there.

Having said that there is Linux kernel Out of Memory (OOM) on keeping the score of each process. This is more from the Operating System Linux. Thus if a certain process reach the score threshold, this process will be killed. Please refer to the following url for information on OOM:
https://dev.to/rrampage/surviving-the-linux-oom-killer-2ki9

Phantom is an automated response platform. If it is operating at 70-80% of system capacity, it is to be expected that an event surge will buckle the VM. This is not best practice. Ideally, headroom for surge events should be planned for, and VM specs adjusted accordingly.

Additionally, There is script that can be use to monitor the container status threshold using REST API:
https://my.phantom.us/kb/47/
This would require user login. You would need to register to phantom on getting the login credentials.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

The system health here is basically the reflection of the phantom instance OS Memory, Load average and Disk Usage. Also the utilisation of the memory and CPU of the processes. There is no threshold where it is impacting phantom performance as long as the resource still available. The utilisation can be more than 90% and Phantom still working fine because the resources are still there.

Having said that there is Linux kernel Out of Memory (OOM) on keeping the score of each process. This is more from the Operating System Linux. Thus if a certain process reach the score threshold, this process will be killed. Please refer to the following url for information on OOM:
https://dev.to/rrampage/surviving-the-linux-oom-killer-2ki9

Phantom is an automated response platform. If it is operating at 70-80% of system capacity, it is to be expected that an event surge will buckle the VM. This is not best practice. Ideally, headroom for surge events should be planned for, and VM specs adjusted accordingly.

Additionally, There is script that can be use to monitor the container status threshold using REST API:
https://my.phantom.us/kb/47/
This would require user login. You would need to register to phantom on getting the login credentials.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...