Splunk SOAR

SubSearch Capability of Phantom App

TWiseOne
Path Finder

I have a correlation search that uses 2 sub-searches using the inputlookup & NOT commands for whitelisted devices/IPs.

When I configure the Phantom App Saved Search Export it finds no results.

However if I expand the whole search (CMD+SHIFT+E) it returns results fine.

Are there any limitations to the sub-search capability of the app? If not is there something I am missing in the configuration of the correlation search or Phantom Forwarding config?

cblumer_splunk
Splunk Employee
Splunk Employee

That issue is typically caused by the permissions defined on the Saved Search in question:

Permissions
When the saved search is first created, the configuration is considered private and stored in the user’s directory. For it to be saved in the correct spot and made available to the Phantom app for Splunk for scheduling, the permissions of the saved search need to be modified as follows:

  1. While in context of the saved search app, go to the Settings menu and select ‘Searches, reports, and alerts’.

  2. Select the saved search that you want to make available to the Phantom app for Splunk, for scheduling.

  3. Under Actions, select ‘Edit’ and ‘Edit Permissions’

  4. Change ‘Display For’ to All apps, ‘Run As’ to User, set read/write permissions as appropriate, and click save.

Upon clicking Save, you’ll be dropped back to the ‘Searches, Reports, and Alerts’ screen, where you should now see the Sharing column show ‘Global’ for your search. It will now be available to other apps.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...