SPLUNK ENTERPRISE REQUIREMENTS UPDATE

The Phantom Remote Search app is used for multiple reasons.

Run Playbook in Phantom вЂ“ sends the event(s) that triggered the alert to Phantom and runs the specified playbook on themДЇor more information about the Phantom App for Splunk, review the following documents:.

Send to Phantom вЂ“ sends the event(s) that triggered the alert to Phantom.

This app also contains alert actions that can be used in Splunk Enterprise Security:

There is also an option to create a Data Model Export, which follows the same set of steps used for exporting saved search results to Phantom: Open the Phantom App for Splunk and create a New Saved Search Export to start sending events over. Then, to send events to Phantom, youвЂ™ll need to create a saved search in Splunk where the results of the search are the events you want ingested into Phantom. First, youвЂ™ll need to go through the Phantom Server Configuration page to connect Splunk to Phantom, which will require an automation user in Phantom. The main function of this app is to send data from Splunk to Phantom. The Phantom App for Splunk is a Splunkbase app that is installed in Splunk and connects Splunk to Phantom.

SPLUNK ENTERPRISE REQUIREMENTS UPDATE

update event вЂ“ updates specified notable events within your Splunk Enterprise Security instanceДЇor specific details on using these actions, search for вЂњsplunkвЂќ on the Apps page in Phantom and click the Documentation link:.run query вЂ“ runs an SPL query in Splunk and returns the results of the search to Phantom.post data вЂ“ creates an event in your Splunk instance.get host events вЂ“ retrieves events about a specific host from Splunk.There are four included actions which can be used in playbooks:.It is recommended that you create a new label in Phantom for the events you pull in from Splunk, which will make it easier to find the events in the Analyst Queue in Phantom. To pull events from Splunk to Phantom, youвЂ™ll need to configure the asset settings and ingest settings in your configured asset.The Splunk App for Phantom can do the following: post data to Splunk as events, update notable events, run SPL queries, and pull events from Splunk to Phantom. In the asset settings, youвЂ™ll need the IP/hostname of your Splunk instance as well as a Splunk user with sufficient access to the data you wish to search. Phantom apps that are built by Splunk are installed in Phantom by default, so no installation is required, however, youвЂ™ll need to configure an asset for it. The Splunk App for Phantom is a Phantom app used to connect Phantom to Splunk. Used for monitoring Phantom as a service in Splunk ITSI Pull event data from Splunk, push event data to Splunk, add Splunk actions to Phantom playbooks. The intent of this post is to provide a guide to knowing which one to leverage based upon what environment you are working in and what use cases are driving your requirement. There are multiple apps that can be used to integrate Phantom with Splunk, each exists for a different reason.

Splunk enterprise requirements