Splunk SOAR (f.k.a. Phantom)

How to fix error sendtophantom: Alert action script returned error code=1?

freddy_Guo
Path Finder

Hi, 

We have recently switched from Phantom to SOAR and I'm trying to send our triggered alerts to SOAR. 

The TA we are using is Splunk for SOAR Export

I have tested that from Splunk Enterprise to SOAR connect and it works.

But I keep getting the following error for one alert

 

 

11-04-2022 05:31:21.724 +1100 WARN  sendmodalert [17285 AlertNotifierWorker-0] - action=sendtophantom - Alert action script returned error code=1

11-04-2022 05:31:21.724 +1100 INFO  sendmodalert [17285 AlertNotifierWorker-0] - action=sendtophantom - Alert action script completed in duration=1394 ms with exit code=1

 

 

This question was also asked in alerting as well.
https://community.splunk.com/t5/Splunk-SOAR-f-k-a-Phantom/Unable-to-add-auth-token-or-add-phantom-in...

But I feel like it could be the wrong channel.

 

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...