Splunk SOAR

Issue with Ingesting Splunk Notable Events into Splunk SOAR – Missing Fields like event_id

sgote
New Member

Hello Team,

I’ve been trying to ingest Splunk notable events into Splunk SOAR (Phantom), but I’m facing an issue where not all details are being transferred automatically. I’ve experimented with multiple methods, including:

  1. Using the "Send to Adaptive Response" option with "Send to SOAR."
  2. Utilizing the Splunk App for SOAR Export.(Forwording)
  3. Installing the Splunk App directly on my Splunk SOAR instance.(on poll)

During the application configuration, I enabled the polling option, and data is being ingested through both methods. However, critical fields like event_id and others are missing in the ingested data. Interestingly, when I manually select the "Send to SOAR" option under a notable event, all fields are successfully transferred to SOAR without any issues.

Is there a way to automate the process so that all details, including event_id and other fields, are sent to SOAR consistently? I’ve also attached a screenshot for reference to help clarify the issue.


Manually send sieam to soar:
manually send to soar.png

 

 On poll using :

on poll data.png

Labels (1)
0 Karma

SOARt_of_Lost
Path Finder

My organization ran into a similar issue when we were initially deploying SOAR - we think it was due to our notable events having too many characters and then the entire message getting truncated.

We ended up creating "One Notable to Rule them All" - just a notable that looks for other notables - it also removes fields we don't care about, ignores all suppressed events, and a few other pieces that make sense for our environment. We then also set the alert actions on this notable itself.

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...