It sounds like your IdP is not signing the assertion.  You'll want to want to ensure that is occuring. You can install a browser plugin like SAML-TRACER  to view the assertions as they make their way to Phantom to ensure the signature is present.  While it may not be your IDP - https://github.com/phantomcyber/phantom-community-projects/blob/master/Questions/SSO/SAML/PingFederate/PingFederate10.md has some details of setting up SSO with SAML (that doc is PingFederate specifically). ... View more

Can you walk through which all components are being used? For example are we talking about custom functions or legacy custom functions? If you can provide enough info for me to duplicate the environment, I can chase down the problem.   ... View more

Howdy!  Is it just a single action that needs to be locked or genuinely the entire playbook? Could you provide a little more details? To cut to the chase: we don't have a "lock playbook" kind of action OOB to limit it to 1 concurrent run, but we might be able to figure out how to accommodate your use case. ... View more

Could you provide more info of the set-up in splunk as well as the errors you're getting? ... View more

Howdy! You'll need to pass in container as a parameter to your function. Here is an example of what I believe you are trying to do:   Notice I have a parameter to the custom function called 'container'. I pass that in like this:   With the container available in the CF, you can use collect2 as expected. Interestingly, notice line 17 on the first screenshot. We have to do "container=container[0]" because the Container parameter of collect2 expects a dict but the data comes in as a list, so we have to extract the dict from the list's first element. ... View more

Did you end up doing the extraction on the Splunk side? ... View more

If the values to store aren't particularly sensitive you may consider them in a custom list. I _believe_ the environment variables are only visible to the App itself, not the playbook executing the app. In other words, I don't believe its possible to have the playbook extract some custom environment variable that's configured within the app settings and then pass it to the app. Instead the App would have to know to use that variable.   ... View more

Please see if the following is helpful: https://community.splunk.com/t5/Security/How-to-configure-Phantom-to-use-LDAP-Active-Directory-for/m-p/471157#M10922 ... View more

Any update on your situation? ... View more

So you've got an artifact (e.g. souceAddress = "https://www.somedomain.com") and you want to trim out a portion of it (e.g. somedomain.com) to make available for downstream blocks? ... View more

The Splunk app for Phantom can poll Splunk and create containers. Alternatively, the Phantom App for Splunk can be configured to send events from Splunk to Phantom. See: https://splunkbase.splunk.com/app/3411/ https://my.phantom.us/4.8/docs/app_reference/phantom_splunk ... View more

To add on to this, any App in phantom that has as "on-poll" action can be configured for data ingestion on the associated type. We also allow you to write your own apps if they aren't available out of the box. see: https://github.com/phantomcyber/phantom-apps/ https://docs.splunk.com/Documentation/Phantom/4.8/DevelopApps/Overview ... View more

Could you provide some more information? Windows version, general network configuration, any relevant firewall settings, etc.? The apps will record their output in the spawn.log in /var/phantom/logs ... View more

You can see here: https://docs.splunk.com/Documentation/Phantom/4.8/Install/InstallRPM : Provide your Splunk Phantom community credentials when prompted for a username and password. Basic community accounts cannot download or install from RPM, that has to be enabled by a sales engineering within Splunk. Community edition is essentially the OVA. ... View more

Hello, Quick answers for the first two: Question 1) You would have to purchase Phantom for each environment. The per-seat model doesn't work across instances. Your sales engineering can help answer further questions on that . Question 2) This is not something we support today but is a planned feature. For question 3, there is a blog here: https://www.splunk.com/en_us/blog/conf-splunklive/introducing-the-splunk-phantom-platform-version-4-0.html (which is a little dated but still in the 4.x family) and documentation here: https://docs.splunk.com/Documentation/Phantom/4.8/Admin/Clustering ... View more

Would you be able to post the details of your fix in case anyone else runs across the same problem? ... View more

Can you provide more details on what configuration you have set on both sides? Also have you checked out: https://my.phantom.us/4.5/docs/admin/splunk ? ... View more

Phantom runs on Linux, not Windows. You may be running Phantom on Linux on Windows (i.e. Phantom -> VirtualBox -> CentOS) but you'd need to get the underlying Linux system an audio device and driver. You cannot directly give it access to the windows audio subsystem. You may be able to add a virtual sound device (if you're using vmware or virtualbox or the like) and then configure Linux to use that and play audio. If you get that working, you'll have to work out the right command(s) to play the sound and then build that into your playbook(s) (using something like ssh into the host). Overall, this will be pretty complicated to do directly. Finding an API you can hit that plays a sound would likely be much easier. ... View more

Yes, I believe so but I don't have a non-AD directory with which to test. Feel free to reach out on Phantom-Community slack to @sam_phantom and I'd be happy to work with you. ... View more

Did the link and advice from @ansusabu and/or @WalshyB help you get this solved? ... View more