Splunk SOAR (f.k.a. Phantom)

How to get Splunk fields as artifacts into Phantom?

andreasbischoff
Explorer

Hi,

trying to get Palo Alto alerts for critical, high and medium threat alerts from Splunk into Phantom.

In phantom I managed to configure access to Spunk.

Query:
eventtype=pan* type=THREAT (severity=critical OR severity=high OR severity=medium)

Fields to save:
app,threat,category,dest,dest_hostname,url,log_subtype,src_user

I'm getting the events into Phantom,. but the field values are all empty?

Regards,
Andreas

Labels (3)
Tags (1)
0 Karma
1 Solution

rgresham_splunk
Splunk Employee
Splunk Employee

Andreas,

The best practice is to use the data sources to push to Phantom verses using the app to pull. This can be configured in the Splunk Instance by following the directions seen here: https://my.phantom.us/4.1/docs/admin/splunk. You will need to install the Splunkbase Phantom App (https://splunkbase.splunk.com/app/3411/)

You can still use the app, but you must ensure that you have on_poll_query configured for 'Query to use with On Poll
and on_poll_display for Fields to save with On Poll. Empty on_poll_display will present all the available fields configured.

With that said, can you try just a basic index= search and see if that returns data?

View solution in original post

andreasbischoff
Explorer

Thanks a lot.

I'll try it this way then.
It is a bit confusing, having a Splunk app for Phantom and a Phantom app for Splunk 🙂

Regards,
Andreas

0 Karma

rgresham_splunk
Splunk Employee
Splunk Employee

Andreas,

The best practice is to use the data sources to push to Phantom verses using the app to pull. This can be configured in the Splunk Instance by following the directions seen here: https://my.phantom.us/4.1/docs/admin/splunk. You will need to install the Splunkbase Phantom App (https://splunkbase.splunk.com/app/3411/)

You can still use the app, but you must ensure that you have on_poll_query configured for 'Query to use with On Poll
and on_poll_display for Fields to save with On Poll. Empty on_poll_display will present all the available fields configured.

With that said, can you try just a basic index= search and see if that returns data?

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!