Splunk SOAR (f.k.a. Phantom)

invalid token error while communicating through rest API with phantom using splunk

rajafarhat16
New Member

alt text

Labels (3)
0 Karma

Crypt
Observer

Not OP but my issue was that I'd allowed the wrong IP address. I'd discounted this as a possibility but when I checked the logs on the Phantom server (/var/log/nginx/access.log) I found that the IP of my Splunk server was not what I'd expected (vitulisation messiness).

Thanks to the others in this thread.

0 Karma

cblumer_splunk
Splunk Employee
Splunk Employee

Areas to check:

  1. Automation user on the Phantom side used for the Splunk integration - check the "Allowed IPs" config, this needs to allow for the Splunk search head to communicate with the Phantom host to create new containers/artifacts via the Forwarding Config
  2. Make sure you're entering the entire 'ph-auth-token' value on the Phantom Server Configuration
  3. Check the $splunk_home/var/log/splunk/phantom_configuration.log file for more details

Please post more information to aid in finding a fix.

0 Karma

rajafarhat16
New Member

can anyone here to help me in this regard ?

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

Can you provide more details on what configuration you have set on both sides? Also have you checked out: https://my.phantom.us/4.5/docs/admin/splunk ?

0 Karma

rajafarhat16
New Member

thanks i solved my issue

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

Would you be able to post the details of your fix in case anyone else runs across the same problem?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...