Splunk SOAR (f.k.a. Phantom)

Splunk App for Phantom to export Raw Logs

rsantoso_splunk
Splunk Employee
Splunk Employee

I am using App Version 2.5.23:

Go to the app and click on “new saved search Export” I have created the saved searches to call onto the app as shown below (I have created search with “table” ).

Search used is :

index=symantec vendor_action="Left alone" Disposition!="Good" | table _time,_raw,Computer_Name,file_hash,file_name,file_path,Risk_Name,Risk_Level,Disposition,user_email,Confidence,eventtype,dest_ip,Location,Occurrences | dedup Computer_Name,file_hash

But when I am trying to use auto extract and select _raw in the field its not being saved while other all fields from the “table command ” has been taken by the configuration.

Labels (2)
Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

The _raw field is not being saved after submitting the save button. This is due to the _raw field is not part of the Phantom Common Event Format (CEF).

_raw field is intentionally not saved by design.

There is workaround by performing the following:
After extracting the _raw field, enter the CEF field as "message". This will put the _raw data into message field in Phantom.
This will allow you to save the _raw field. The _raw data will be in the message field in Phantom.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

The _raw field is not being saved after submitting the save button. This is due to the _raw field is not part of the Phantom Common Event Format (CEF).

_raw field is intentionally not saved by design.

There is workaround by performing the following:
After extracting the _raw field, enter the CEF field as "message". This will put the _raw data into message field in Phantom.
This will allow you to save the _raw field. The _raw data will be in the message field in Phantom.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!