Phantom health alert notification

[harishlnu]

Hi team,

Could you please help me on how to get health alert notification in phantom.

Thanks in advance.

Regards,

Harisha

[venkatasri]

Hi @harishlnu 

One of the ways is using Rest API - /rest/health of SOAR - status field contains all the daemons health information and additional info on resource utilization.

https://docs.splunk.com/Documentation/SOAR/current/PlatformAPI/RESTInfo#.2Frest.2Fhealth

To monitor I would run an external script or if you are using Splunk Enterprise - by using | restsoar command you can call the above Rest API and create an alert.  You should install official  https://splunkbase.splunk.com/app/6361 Splunk App for SOAR to use  | restsoar command.

--------

Srikanth Yarlagadda