Splunk SOAR

How to get Splunk fields as artifacts into Phantom?

andreasbischoff
Explorer

Hi,

trying to get Palo Alto alerts for critical, high and medium threat alerts from Splunk into Phantom.

In phantom I managed to configure access to Spunk.

Query:
eventtype=pan* type=THREAT (severity=critical OR severity=high OR severity=medium)

Fields to save:
app,threat,category,dest,dest_hostname,url,log_subtype,src_user

I'm getting the events into Phantom,. but the field values are all empty?

Regards,
Andreas

Labels (3)
Tags (1)
0 Karma
1 Solution

rgresham_splunk
Splunk Employee
Splunk Employee

Andreas,

The best practice is to use the data sources to push to Phantom verses using the app to pull. This can be configured in the Splunk Instance by following the directions seen here: https://my.phantom.us/4.1/docs/admin/splunk. You will need to install the Splunkbase Phantom App (https://splunkbase.splunk.com/app/3411/)

You can still use the app, but you must ensure that you have on_poll_query configured for 'Query to use with On Poll
and on_poll_display for Fields to save with On Poll. Empty on_poll_display will present all the available fields configured.

With that said, can you try just a basic index= search and see if that returns data?

View solution in original post

andreasbischoff
Explorer

Thanks a lot.

I'll try it this way then.
It is a bit confusing, having a Splunk app for Phantom and a Phantom app for Splunk 🙂

Regards,
Andreas

0 Karma

rgresham_splunk
Splunk Employee
Splunk Employee

Andreas,

The best practice is to use the data sources to push to Phantom verses using the app to pull. This can be configured in the Splunk Instance by following the directions seen here: https://my.phantom.us/4.1/docs/admin/splunk. You will need to install the Splunkbase Phantom App (https://splunkbase.splunk.com/app/3411/)

You can still use the app, but you must ensure that you have on_poll_query configured for 'Query to use with On Poll
and on_poll_display for Fields to save with On Poll. Empty on_poll_display will present all the available fields configured.

With that said, can you try just a basic index= search and see if that returns data?

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...