Hi mzambrana123, Thanks for the candid feedback, but I'm not sure you've understood the question correctly. The problem isn't sending a Notable to Phantom, it's using Phantom to tell ES the Notable should be closed. If you're using latest version of the Splunk app within Phantom (1.3.41 at the time of writing) the action to update a status is broken as it assumes that notables will have an entry in the Incident Review lookup, which isn't true until someone makes a change to the case in ES i.e. assigns it to an analyst, changes, the status, leaves a comment etc.
... View more