Splunk SOAR (f.k.a. Phantom)

Why am I getting an error when using the Send to Phantom alert action?

rplas
SplunkTrust
SplunkTrust

Splunk Version: 7.1.2
Phantom App for Splunk Version: 2.5.23

My alerts are being triggered successfully, but there is an error sending to Phantom.

In /opt/splunk/var/log/splunk/phantom_forwarding.log I get the following line:

phantom_forward:109 - /opt/splunk/etc/apps/phantom/bin/scripts/phantom_forward.py called without the correct set of parameters.

and the lines of code in question are:

if len(sys.argv) < 9:
    logger = PhantomConfig.get_logger('forwarding')
    logger.error('{} called without the correct set of parameters.'.format(sys.argv[0]))
    sys.exit(0)

With some digging I've determined that sys.argv in this case is an array with one item which is the name of the file.

I'm wondering if this is caused by an error on my part (misconfigured alert?) or maybe a bug in the Phantom app code.

Labels (2)

AustinKidd
New Member

Hi, sorry I don't have a full answer, but hopefully this helps you along in your search. I was digging into this problem myself in a lab and realized that my alert action was doing fine (in fact, I'm pretty sure the alert action doesn't call the phantom_forward.py script). Looking at the code in the app, phantom_forward actually gets called through the restmap.conf (via phantom_rest), so I'd guess Phantom is trying to reach out to that rest endpoint with the wrong parameters, but I'm not sure where that's set up. In the lab I'm in, I'm seeing it happen once a minute.

0 Karma
Get Updates on the Splunk Community!

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...

How to Troubleshoot our Splunk HEC Endpoint

This blog post is part of an ongoing series on OpenTelemetry. In this blog post, we will explore the best way ...