Splunk SOAR (f.k.a. Phantom)

Why don't I see Splunk events for containers with Phantom-ingested emails?

gf13579
Communicator

If I try to search phantom container events by label, status or several other fields, I don't see events relating to containers created by the email poll-based ingestion feature of Phantom.

Why don't they show up?

Labels (1)
0 Karma
1 Solution

gf13579
Communicator

The json logged by Phantom break's Splunk's parsing. Early fields in the json will be available for you to search on, but later fields such as label and status won't be automatically extracted.

I think the raw_email field is the one that breaks things. Based on a quick test, a json linter had no problem with what phantom was sending Splunk, so the issue seems more with Splunk parsing the dta.

As a workaround - extract the relevant fields at search time (or define your own local props):

index=phantom_container 
| rex "\x22label\x22: \x22(?<label>[^\x22]+)\x22" 
| rex "\x22status\x22: \x22(?<status>[^\x22]+)\x22" 
| search label!="servicenow-poll" status=new 
| eval _time = strptime(create_time,"%Y-%m-%dT%H:%M:%S") + 10*60*60 
| stats min(_time) as _time, values(label) as label by id 
| timechart span=10m count by label

 

View solution in original post

0 Karma

gf13579
Communicator

The json logged by Phantom break's Splunk's parsing. Early fields in the json will be available for you to search on, but later fields such as label and status won't be automatically extracted.

I think the raw_email field is the one that breaks things. Based on a quick test, a json linter had no problem with what phantom was sending Splunk, so the issue seems more with Splunk parsing the dta.

As a workaround - extract the relevant fields at search time (or define your own local props):

index=phantom_container 
| rex "\x22label\x22: \x22(?<label>[^\x22]+)\x22" 
| rex "\x22status\x22: \x22(?<status>[^\x22]+)\x22" 
| search label!="servicenow-poll" status=new 
| eval _time = strptime(create_time,"%Y-%m-%dT%H:%M:%S") + 10*60*60 
| stats min(_time) as _time, values(label) as label by id 
| timechart span=10m count by label

 

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.