About nishu3788

nishu3788 · ‎12-02-2020

Hi Everyone, Can someone help me, How I can form a Splunk Notable URL when I have Notable id (event_id). The use case is- I am ingesting Notables into Phantom and I need to publish Notable URL for each container in Phantom so that Analyst can click on the URL and can navigate to respective Notable alert in Splunk ES.

cblumer_splunk · ‎08-28-2019

DHCP can optionally be used for a lab/dev Phantom instance. Are you defining the network adapter settings for the VM in ESXI/VM Workstation/Virtual Box? Are you having trouble reaching the Phantom Web UI? You'll also want to set the needed configuration in the "Configure Network" page within the menu that is displayed when booting up the OVA. https://my.phantom.us/4.5/docs/installation/virtual#AssignVAIP

nickhills · ‎03-21-2019

It depends on your exact setup, but common ports are (all TCP) 8000 for web 8089 for api 9997 and 9998 for forwarders (non SSL and SSL) 9000 for idx replication (although this could be anything) DB connect will use relevant ports for your DB engines, but those will be egress from DBX

DalJeanis · ‎07-23-2018

Per George, an expert on Splunk multisite deployments at Rational Cyber, "It seems like their WAN is saturated by replication. They should look at queue fullness and at tcp out connections for replication."

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎07-23-2018

Online Status	Offline
Date Last Visited	‎12-02-2020 03:45 AM

How can I form Notable URL link if I have notable ...

Unable to do Splunk Phantom ova install due to sta...

How to Re-enable firewalld service on Splunk serve...

What are the measures to check Splunk performance ...

How can I form Notable URL link if I have notable ...

Re: Unable to do Splunk Phantom ova install due to...

Re: How to Re-enable firewalld service on Splunk s...

Re: What are the measures to check Splunk performa...