Splunk SOAR

How to add filed from raw data into artifacts

Qingguo
Engager

when the original syslog was forwarded to phantom, some key filed(like srcIP/dstIP) was missing artifact.   these key filed was in raw_data if we search artifiact in splunk.

can phantom identify/parse these field and add artifact automatically ?

Labels (1)
Tags (1)
0 Karma

Qingguo
Engager

It has been resolved by installing add-on and mapping cef field ,  thanks

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...