Hi, sorry I don't have a full answer, but hopefully this helps you along in your search. I was digging into this problem myself in a lab and realized that my alert action was doing fine (in fact, I'm pretty sure the alert action doesn't call the phantom_forward.py script). Looking at the code in the app, phantom_forward actually gets called through the restmap.conf (via phantom_rest), so I'd guess Phantom is trying to reach out to that rest endpoint with the wrong parameters, but I'm not sure where that's set up. In the lab I'm in, I'm seeing it happen once a minute.
... View more