Splunk SOAR (f.k.a. Phantom)

invalid token error while communicating through rest API with phantom using splunk

rajafarhat16
New Member

alt text

Labels (3)
0 Karma

Crypt
Observer

Not OP but my issue was that I'd allowed the wrong IP address. I'd discounted this as a possibility but when I checked the logs on the Phantom server (/var/log/nginx/access.log) I found that the IP of my Splunk server was not what I'd expected (vitulisation messiness).

Thanks to the others in this thread.

0 Karma

cblumer_splunk
Splunk Employee
Splunk Employee

Areas to check:

  1. Automation user on the Phantom side used for the Splunk integration - check the "Allowed IPs" config, this needs to allow for the Splunk search head to communicate with the Phantom host to create new containers/artifacts via the Forwarding Config
  2. Make sure you're entering the entire 'ph-auth-token' value on the Phantom Server Configuration
  3. Check the $splunk_home/var/log/splunk/phantom_configuration.log file for more details

Please post more information to aid in finding a fix.

0 Karma

rajafarhat16
New Member

can anyone here to help me in this regard ?

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

Can you provide more details on what configuration you have set on both sides? Also have you checked out: https://my.phantom.us/4.5/docs/admin/splunk ?

0 Karma

rajafarhat16
New Member

thanks i solved my issue

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

Would you be able to post the details of your fix in case anyone else runs across the same problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...