How to get Splunk fields as artifacts into Phantom?

[andreasbischoff]

Hi,

trying to get Palo Alto alerts for critical, high and medium threat alerts from Splunk into Phantom.

In phantom I managed to configure access to Spunk.

Query:
eventtype=pan* type=THREAT (severity=critical OR severity=high OR severity=medium)

Fields to save:
app,threat,category,dest,dest_hostname,url,log_subtype,src_user

I'm getting the events into Phantom,. but the field values are all empty?

Regards,
Andreas

[andreasbischoff]

Thanks a lot.

I'll try it this way then.
It is a bit confusing, having a Splunk app for Phantom and a Phantom app for Splunk 🙂

Regards,
Andreas

[rgresham_splunk · Accepted solution]

Andreas,

The best practice is to use the data sources to push to Phantom verses using the app to pull. This can be configured in the Splunk Instance by following the directions seen here: https://my.phantom.us/4.1/docs/admin/splunk. You will need to install the Splunkbase Phantom App (https://splunkbase.splunk.com/app/3411/)

You can still use the app, but you must ensure that you have on_poll_query configured for 'Query to use with On Poll
and on_poll_display for Fields to save with On Poll. Empty on_poll_display will present all the available fields configured.

With that said, can you try just a basic index= search and see if that returns data?