Splunk Tech Talks
Deep-dives for technical practitioners.

Splunk Phantom App Building the Easy Way

melissap
Splunk Employee
Splunk Employee

View our Tech Talk: Security Edition, Splunk Phantom App Building the Easy Way 

(view in My Videos)

Splunk Phantom apps provide a way to extend the Phantom platform by adding connectivity to third party security technologies in order to run actions. Given the broad set of technologies that can be orchestrated during cyber response, apps allow users and partners to add their own custom functionality within Phantom. Apps are written in Python, and in order to automate successfully, you must have at least one person that understands how apps work, how to troubleshoot an app, how to modify an app, and how to build a new app from scratch. 

This talk will walk you through the open source Phantom Test Harness you can use to greatly simplify the Phantom App building/testing process. 

Contributors

Write for the Community Blog

Have a tip, real-world lesson, or project to share? We’ll partner with you to refine your draft, sharpen your headings, and spotlight your work.

Get Updates on the Splunk Community!

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...