Splunk SOAR (f.k.a. Phantom)

Can deleted events be restored?

CS_
Path Finder

I read in another thread that events are not really "deleted" as such, but that they are simply marked in a way that removes them from the search - however that may be just relating to SPLUNK.

So if you have a need to restore a deleted event + it's associated containers, actions, logs, etc, is there a way to do that in SOAR/Phantom

Labels (1)
0 Karma
1 Solution

CS_
Path Finder

Hey @phanTom 

Thanks for the response. Luckily there is no loss of important data, they were just test events we were sending from Splunk.

If there is no way to do it through the frontend, I'll mark it as a "cannot be done".

Best,

Chris

View solution in original post

0 Karma

phanTom
SplunkTrust
SplunkTrust

@CS_  it may be similar in that the database entry/entries may only be masked from the UI but you would need to go digging through postgres database to find all the relevant entries, if they still exist!

This is why the ability to delete is not allowed on any out of the box account (except admin) as it is not simple to recover from a deletion.

I would recommend a support call to verify this and for them to advise how, if at all, you might be able to retrieve the data. 

If you externalise your data to Splunk you might be able to "stitch" the data back together but it wouldn't be simple. 

0 Karma

CS_
Path Finder

Hey @phanTom 

Thanks for the response. Luckily there is no loss of important data, they were just test events we were sending from Splunk.

If there is no way to do it through the frontend, I'll mark it as a "cannot be done".

Best,

Chris

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...