Splunk SOAR (f.k.a. Phantom)

Phantom with Splunk Cloud?

fmh
Engager

Hi,
we are using Splunk Cloud service and would like to extend it with Phantom.
Does anybody know whether this is possible?

Thanks!
-felix

Labels (2)
Tags (2)

cblumer_splunk
Splunk Employee
Splunk Employee

An on-prem/AWS/Azure/GCP instance of Phantom can be used with Splunk Cloud, however a Support case will need to be created in order for the API communication port (default 8089) to be opened for the integration to have connectivity.

Once the connectivity is enabled, a good way to test it out would be to install & configure the Splunk App for Phantom with the required IP/Hostname, port, and user parameters defined.

Here's a KB link for that app:
https://my.phantom.us/4.5/docs/app_reference/phantom_splunk#test-connectivity

woodcock
Esteemed Legend

Surely this is coming soon!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...