Splunk SOAR (f.k.a. Phantom)

Splunk App for Phantom to export Raw Logs

rsantoso_splunk
Splunk Employee
Splunk Employee

I am using App Version 2.5.23:

Go to the app and click on “new saved search Export” I have created the saved searches to call onto the app as shown below (I have created search with “table” ).

Search used is :

index=symantec vendor_action="Left alone" Disposition!="Good" | table _time,_raw,Computer_Name,file_hash,file_name,file_path,Risk_Name,Risk_Level,Disposition,user_email,Confidence,eventtype,dest_ip,Location,Occurrences | dedup Computer_Name,file_hash

But when I am trying to use auto extract and select _raw in the field its not being saved while other all fields from the “table command ” has been taken by the configuration.

Labels (2)
Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

The _raw field is not being saved after submitting the save button. This is due to the _raw field is not part of the Phantom Common Event Format (CEF).

_raw field is intentionally not saved by design.

There is workaround by performing the following:
After extracting the _raw field, enter the CEF field as "message". This will put the _raw data into message field in Phantom.
This will allow you to save the _raw field. The _raw data will be in the message field in Phantom.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

The _raw field is not being saved after submitting the save button. This is due to the _raw field is not part of the Phantom Common Event Format (CEF).

_raw field is intentionally not saved by design.

There is workaround by performing the following:
After extracting the _raw field, enter the CEF field as "message". This will put the _raw data into message field in Phantom.
This will allow you to save the _raw field. The _raw data will be in the message field in Phantom.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...