if its still required, you could do a filter that would match all artifacts, i.e. id != "" and add code to the phantom.condition() function with limit=1 added into the parameters. matched_artifacts_1, matched_results_1 = phantom.condition( container=container, conditions=[ ["artifact:id", "!=", ""], ], name="filter_first_artifact:condition_1",limit=1) This should give you the first artifact in that container (first created). You can then use that filtered datapath to update only that artifact. ... View more

Hi, This will be dependent on what you want to achieve via automation with the Crowdstrike App. For example, if you want to update detections, then the API Client you permission should have Read and Write to Detections. We usually select the options we believe are necessary and then if additional permissions are required, we add them. ... View more

Hi, Have you tried the previous version 1.0.105? We raised a support case for the latest version for similar issues and they are looking into a fix as the state file isn't filled out correctly. Oldest first for us didn't work at all, so we had to use latest which puts everything out of order. ... View more

use something like this on the end? | stats count as Total count(eval(Status=="UP")) as "up_count" count(eval(Status=="DOWN")) as "down_count" Or index=opennms eventuei="uei.opennms.org/thresholds/bgpPeerState/XOM*" "WANRT*" "10.253*" | rex field=eventuei "uei.opennms.org/thresholds/bgpPeerState/(?.+)" | rex "peer: (?.*), eventseverity" | eval Status=case(bgpPeerState=="XOM-rearm", "UP", bgpPeerState=="XOM-falling", "DOWN", 1=1, "Other") | dedup nodelabel | stats dc(PEER_IP) as Total by Status ... View more

From my understanding, this is not possible but it happens because when it needs to trigger a playbook, it spots a time difference between artifact 1's creation and e.g. artifact 5's so it causes another trigger. If you use event forwarding, it will not separate them into multiple artifacts, like "send to phantom" does for multi-value fields. This would stop it running multiple times but would then need a custom function in a playbook to separate again with the run_automation flag set to false. I would be interested in knowing a way around this if in the time this question has been up, you've found a solution 🙂 ... View more

https://docs.splunk.com/Documentation/PhantomApp/2.7.5/Install/ConfigureCerts, see "Manage HTTPS certificate validation using configuration files", did you do those steps followed by a restart? ... View more

Hey, The send to phantom action will extract artifacts from the splunk result for each row present. If you have multi-value fields in the result then it will extract one for each when using the "send to phantom" adaptive response action. Best practice is to use the event forwarding portion of the Phantom app, monitoring notable and configuring the mapping of cef fields to control which fields are sent to Phantom. This also doesn't create multiple artifacts, you will have one with a string of all the multi-values joined together (which could require playbook actions to separate again) ... View more

You can use the container deletion script to remove events from phantom: https://my.phantom.us/kb/80/ Quickest way would likely be to run the command per label you have in Phantom. ... View more

You could try this? props.conf [your_sourcetype] EXTRACT-username,project = ^.*?\logs\D+\d_(?[^]+)(?[^_]+) in source You will need to adjust the regex as I made it pretty quick and it is unlikely to match all the cases you have which you haven't provided. Credit/Source: https://answers.splunk.com/answers/600776/multiple-fields-extractionm-using-propsconf.html ... View more

yes, they are definitely not part of license usage ... View more

you're welcome, try not to put the title in all caps next time 😉 ... View more

Regex does not require it to be wrapped in quotes, it may be thinking that is part of the string? Also have you checked the metadata to ensure you are able to see the extraction? local.meta [] access = read : [*], write : [admin,...] export = system ... View more

I haven't seen one online, but some of the key questions you would want to ask would be.. Application Name - So that you can give a relevant name to the index Use case - what are they looking to get out of Splunk Method of Collection - (Can a Universal Forwarder be installed at the location the logs reside?, Syslog, API?) Log Path (Universal Forwarder Collection) - Path logs reside (Does the splunk role (if splunk role is running splunk) have access to read that file) Network - Do any ports need to be opened to get the flow in place? License Usage - Predicted volume of onboarding so that you can plan the license accordingly Access Limitations - Does access to these logs need to be restricted to a specific team and will it need to be segregated? (e.g. LDAP integration) Sample Events - obtain a few sample events so that you know how to parse the data and whether any extractions can be done. These are just some I can think off the top of my head, hope it helps 🙂 ... View more

Hey, This can be done through css - within the /appserver/static directory of the app you want to store the css file in. for example, if the dashboard is in the search app, then /etc/apps/search/appserver/static/example.css. Within the dashboard xml Then your css file will have the changes to the text input that you want. For width changes- #inputid { width: 200px !important; } I encourage using inspect element and and selecting the text input and adding css you want to preview what the changes would look like and to finetune it to what you require. Hope this helps a little. ... View more

Thanks! Works perfectly 🙂 ... View more