Splunk SOAR (f.k.a. Phantom)

Phantom: How to generate a report on cases that are created ?



I am looking for a way to generate a summary report on cases that we have in Phantom ? Which will include case ID, case name, Assignee, Start data, end date , status etc.

I dont find an option to generate such reports in Phantom GUI currently. Please help me if anybody found any solution for this.
I am looking for ways to pull data with the help of Rest API. Please post if anyone has worked on this so far ?

Thank you,

Labels (1)
Tags (1)


There currently isn't a great way to generate custom reports from the UI but I think getting data from the API and building your own report generator is the way to go.

Documentation for the REST API can be found here: https://docs.splunk.com/Documentation/Phantom/4.8/PlatformAPI/Using

The Container API documentation can be found here: https://docs.splunk.com/Documentation/Phantom/4.8/PlatformAPI/RESTContainers

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...