Splunk SOAR

Splunk App for Phantom to export Raw Logs

rsantoso_splunk
Splunk Employee
Splunk Employee

I am using App Version 2.5.23:

Go to the app and click on “new saved search Export” I have created the saved searches to call onto the app as shown below (I have created search with “table” ).

Search used is :

index=symantec vendor_action="Left alone" Disposition!="Good" | table _time,_raw,Computer_Name,file_hash,file_name,file_path,Risk_Name,Risk_Level,Disposition,user_email,Confidence,eventtype,dest_ip,Location,Occurrences | dedup Computer_Name,file_hash

But when I am trying to use auto extract and select _raw in the field its not being saved while other all fields from the “table command ” has been taken by the configuration.

Labels (2)
Tags (1)
0 Karma
1 Solution

rsantoso_splunk
Splunk Employee
Splunk Employee

The _raw field is not being saved after submitting the save button. This is due to the _raw field is not part of the Phantom Common Event Format (CEF).

_raw field is intentionally not saved by design.

There is workaround by performing the following:
After extracting the _raw field, enter the CEF field as "message". This will put the _raw data into message field in Phantom.
This will allow you to save the _raw field. The _raw data will be in the message field in Phantom.

View solution in original post

0 Karma

rsantoso_splunk
Splunk Employee
Splunk Employee

The _raw field is not being saved after submitting the save button. This is due to the _raw field is not part of the Phantom Common Event Format (CEF).

_raw field is intentionally not saved by design.

There is workaround by performing the following:
After extracting the _raw field, enter the CEF field as "message". This will put the _raw data into message field in Phantom.
This will allow you to save the _raw field. The _raw data will be in the message field in Phantom.

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...