Enable Splunk AR Workflow Automation

Workflow Automation is a beta feature available with Splunk AR version 2.1.0 and later. Workflow Automation integrates Phantom playbooks into AR workspaces to guide users through real-world tasks. To use Workflow Automation, create playbooks in Phantom and then add them to your AR workspaces in the Splunk AR mobile app.

Configure your Phantom instance to use the Workflow Automation feature. Then, Splunk AR mobile app users can enable Workflow Automation on their devices.

To learn about Workflow Automation Security and How it works

Prerequisites

Before using Workflow Automation in Splunk AR, make sure the following tasks are complete:

• Users who are using Workflow Automation have registered their devices to a Splunk instance. See Register your device in Use Splunk Cloud Gateway to register to a Splunk instance.
• You've set up your Splunk AR deployment and have assets with associated AR workspaces. See Set up Splunk AR in the Get started with Splunk AR topic to get started with your Splunk AR deployment.
• You've installed Splunk Phantom. See Get Splunk Phantom for more information about installing Splunk Phantom.
• Your Splunk instance and Splunk Phantom are hosted on the same network or VPC. See the Workflow Automation Device Authentication and Workflow Automation Message Exchange diagram to learn why.
• You need the edit_phantom_configuration capability to complete the admin steps. Users do not need this capability when completing the user steps. See Manage roles and permissions in Splunk to learn about Splunk Phantom permissions and see Configure Splunk AR permissions to learn about playbook permissions in Splunk AR.

Enable Workflow Automation

Complete the following steps in Splunk Cloud Gateway app and the Splunk Mobile app to use Workflow Automation.

Admin steps

In the Splunk Cloud Gateway app, configure your Splunk Phantom instance to use Workflow Automation:

1. Navigate to the Splunk AR tab.
2. Click Configure Phantom.
3. Enter your Phantom username and password.
4. Click Test Connection.
5. Click Save.

Mobile user steps

In the Splunk AR app, users can log in with their Splunk Phantom credentials to enable Workflow Automation:

1. Navigate to Settings.
2. Tap Splunk Apps.
3. Toggle Enable Phantom
4. Enter your Splunk Phantom credentials.
5. Tap Log in. Workflow automation is now enabled.

Add Phantom playbooks to AR workspaces

After enabling Workflow Automation, see Add Phantom playbooks to AR workspaces in Splunk AR (beta) to learn how to add a playbook to a workspace.