So what I basically have is an integration between splunk/phantom/servicenow where Splunk forwards correlated search events to phantom using the "Phantom App-on" with the Event forwarding feature and then phantom executes a playbook to create a Servicenow Ticket. What I want to do is update the "comment" field for each Notable Event in ES that is associated with the "Correlated search event" that was pushed from Splunk to phantom with the ticket number that was created. So I'm trying to figure out if there is a shared value that's in both the "Notable event" and "Correlated Search Event" so I can link the two and update the "Notable Event" comments field. Maybe there is a better approach to doing this?  ... View more