Splunk SOAR (f.k.a. Phantom)

Synchronization error while running a single playbook on different events at same time

ansusabu
Communicator

I have a usecase configured in Splunk and we are getting multiple events in phantom at the same time.
When I try to run a playbook, only one event runs an action block and the rest of the events through 'synchronization' error.

Do we have any other way?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...