Try using 'fields + *' ... View more

Try using a schedule instead of real time. https://answers.splunk.com/answers/813705/automatically-forward-events-to-phantom.html#answer-815991 ... View more

If you can, share the screenshot of the configuration that you have done ... View more

Then you can save the query in Splunk and use the Phantom app in Splunk. Goto 'export new saved search' , then select the query you saved. If you are not receiving the fields you are expecting in Phantom, then use, stats command or field command in the query to extract the required fields. ... View more

Create an alert for the query and add the action as 'send events to phantom'. Add a schedule for running the query as well while creating the alert. https://my.phantom.us/4.6/docs/admin/splunk ... View more

Phantom has some EDR/firewall apps that can help in polling data from the EDR/firewall sources. If it is not present, you can use API to ingest data into phantom. ... View more

I didn't get your question. But I assume that you are trying to connect Splunk and Phantom through Phantom app in Splunk. For configuring Phantom in Splunk, goto phantom configuration and add the authorization token which you will get from Phantom. You can get the authorization token from phantom: goto Administration in main menu-> User Management-> user-> click on the 'automation' user., copy the authorization token and paste it in Splunk ... View more

'deflate item' is available in 'phantom app'(Phantom App for Phantom) ... View more

You can use notable macro to pull the evnts from Splunk to Phantom. Thus you will get the event_id as artifact. ... View more

I resolved the issue by restoring the VM image. ... View more

Check the json file that you are receiving after the action. And try expanding the time range ... View more

You can use 'stats' at the end of query to return the necessary fields you require. ... View more

Need more clarity on this question. ... View more

duplicate question: https://answers.splunk.com/answers/783481/vpe-debugger-issue-no-response-on-test.html#answer-783484 ... View more

You can stop the phantom server using the script using the stop script available in the below location /opt/phantom/bin/stop_phantom.sh And start the server using the below script : /opt/phantom/bin/start_phantom.sh ... View more

You have to install the module in your server first,then try to import the module in the global block. ... View more

You can give a custom python script in the Rest API app, which creates container in phantom. Here is the pseudo code: # Acquire some container/artifact data to post container = get_container() artifacts = get_artifact_list_for_container(container) # post your container do_post_container(container) # Set run_automation to false on all but the last one for artifact in artifacts[:-1]: artifact["run_automation"] = False do_post_artifact(artifact) do_post_artifact(artifacts[-1]) You can view this code at the last part of https://my.phantom.us/4.2/docs/rest/overview ... View more

Have you tried this query in Splunk and made sure that it is working? In 1st query, the problem is "{<>}", If you want to include the braces, then you need to escape the braces using double braces ... View more