Splunk SOAR (f.k.a. Phantom)

Why don't I see Splunk events for containers with Phantom-ingested emails?

gf13579
Communicator

If I try to search phantom container events by label, status or several other fields, I don't see events relating to containers created by the email poll-based ingestion feature of Phantom.

Why don't they show up?

Labels (1)
0 Karma
1 Solution

gf13579
Communicator

The json logged by Phantom break's Splunk's parsing. Early fields in the json will be available for you to search on, but later fields such as label and status won't be automatically extracted.

I think the raw_email field is the one that breaks things. Based on a quick test, a json linter had no problem with what phantom was sending Splunk, so the issue seems more with Splunk parsing the dta.

As a workaround - extract the relevant fields at search time (or define your own local props):

index=phantom_container 
| rex "\x22label\x22: \x22(?<label>[^\x22]+)\x22" 
| rex "\x22status\x22: \x22(?<status>[^\x22]+)\x22" 
| search label!="servicenow-poll" status=new 
| eval _time = strptime(create_time,"%Y-%m-%dT%H:%M:%S") + 10*60*60 
| stats min(_time) as _time, values(label) as label by id 
| timechart span=10m count by label

 

View solution in original post

0 Karma

gf13579
Communicator

The json logged by Phantom break's Splunk's parsing. Early fields in the json will be available for you to search on, but later fields such as label and status won't be automatically extracted.

I think the raw_email field is the one that breaks things. Based on a quick test, a json linter had no problem with what phantom was sending Splunk, so the issue seems more with Splunk parsing the dta.

As a workaround - extract the relevant fields at search time (or define your own local props):

index=phantom_container 
| rex "\x22label\x22: \x22(?<label>[^\x22]+)\x22" 
| rex "\x22status\x22: \x22(?<status>[^\x22]+)\x22" 
| search label!="servicenow-poll" status=new 
| eval _time = strptime(create_time,"%Y-%m-%dT%H:%M:%S") + 10*60*60 
| stats min(_time) as _time, values(label) as label by id 
| timechart span=10m count by label

 

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...