Splunk Search

How to search for Phantom (SOAR) playbook runs and results?

ben_r
Engager

I have some Phantom playbooks performing tasks that I want to monitor on a Splunk dashboard - runs/day, distinct tasks processed per run, success/retry/failure, things like that. I can see the revision control check-ins by playbook name, but not the individual playbook runs - those are identified with an integer that corresponds to the playbook ID. The playbook ID changes for each check-in and doesn't appear to be included in the check-in event.

Surely someone must have set up a way to track Phantom playbook runs from a Splunk dashboard with a human-readable playbook name  - how should I start going about this?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...