I'm performing a lookup against a csv and need to use two columns (description and function) to return the correct value. However, I have a case where I need to explicitly specify the function, while using a description value from an event. Here's a lookup that works for me: | lookup products.csv ProductDescription as description, ProductFunction as function OUTPUTNEW Name as ProductName What I need to do is this: | lookup products.csv ProductDescription as description, ProductFunction as "Kitchen Appliance" OUTPUTNEW Name as ProductName When the event happens to contain "Kitchen Appliance" as the function, the lookup works, but if I explicitly specify "Kitchen Appliance" as the lookup value, nothing is returned. Is this usage supported?     ... View more

I have a Phantom playbook that will take security-related actions on any arbitrary host on my network. These actions might need to be taken at any time of day, on weekends, holidays, etc., so I need to make sure any member of my 24/7 security operations center can run the playbook. I'm looking for a way they can initiate the playbook without explicitly logging into Phantom. Is there a way that a Splunk dashboard can start a Phantom playbook, after accepting the information required for that playbook (hostname, user ID assigned to that host, etc.)?   ... View more

I am trying to configure the Shodan app for Phantom. In the account settings, the only field to set is the Shodan API key. When I copy and paste from my Shodan account, I get this error whenever I press 'test connectivity': "Response is not a valid JSON. Expecting value: line 1 column 1 (char 0). API Key is not valid. No action executions found." I have tried resetting the api key and using the new value, and get the same error.  Is there something I'm missing?   ... View more

In my Phantom playbook, I'm using a custom code block to generate a string (specifically, a Python dictionary representing matches between two sets of data) that I'd like to add to the container as an artifact. At the end of the playbook, I'll attach that artifact to an email that will be sent out. I'm using the Phantom app with action "Add Artifact" and have not been successful in adding my string as an artifact. Here are the prompts in the app and the values I'm putting in them: name: matches container_id: [blank, as it's optional] label: event source_data_identifier: matches cef_name: matches cef_value: Search_URL_Content:custom_function:matches (the cef name for the string I'm interested in) cef_dictionary: [blank, as it's optional] contains: "matches": ["text"] Every time I run the playbook, I get the following error from Add Artifact: 'add_artifact_1' on asset 'phantom': 1 action failed. (1)For Parameter: {"cef_name":"matches","cef_value"[the string i want to add as an artifact]","contains":"text","context":{"artifact_id":0,"guid":"23efc7d2-f15b-4cb5-a083-f08793cd551d","parent_action_run":[]},"label":"event","name":"matches","source_data_identifier":"matches"} Message: "Error from server. Status code: 400, Details: each value in cef_types must be a list of strings indicating the possible types " I've been working this for several hours and can't find examples to go on....can anyone offer assistance as to what I should enter into these fields to fix this error? Thanks! ... View more

I need to perform forensic analysis on compromised computers, but they are sometimes not online anymore by the time I've seen the AV alert and have Encase up and running. It would be extremely helpful if Splunk could search for that computer (ping, Windows Security events, whatever) email me when the appropriate traffic is observed, and then stop the search. Detecting traffic from the computer and sending the email is no problem - it's how to get the search to stop once the target computer is online that has me stumped. Ideally, I would type something like 'sourcetype="IsOnline" hostname="HackedPC" notify="MyEmail@company.com"', and the search would run until I get the email, without my having to stop it manually. Thanks! ... View more

I am working with the fields srcip and malware-type. I need to show how many instances of each type of malware have been observed for each srcip, and then group them by src_ip. For example: 127.0.0.1: TrojanHorse (2) Worm (1) 192.168.7.256: TrojanHorse (1) 1.8.9.10: Worm (5) Rootkit (2) The code "stats values(malware-type) by srcip" will list the types of malware grouped by srcip, but getting the counts in there (while still grouping by srcip) has me stumped...can anyone help me out? Thanks! ... View more