Splunk SOAR (f.k.a. Phantom)

Add a User to an AD group using Phantom

splunk_user4
Explorer

Would it be easier to use a custom phantom playbook to Add a user to a specific AD group from an event trigger, instead of creating a custom App in splunk using the App builder?

Labels (2)
Tags (1)
0 Karma

phantom_mhike
Path Finder

"Easier depends on experience in each platform and available resources. If you have phantom and you are already using it for other automation, then yes, it is likely to be simpler. I wouldn't recommend setting up a phantom instance for this single case. And if your experience in phantom is limited, it may be much faster to go the splunk app route. Phantom introduces more moving parts to your process so adding phantom for adding a user to an AD group doesn't make sense but using phantom that is already operational and part of your porcess anyway could very much make the job easier.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...