Filter indicator records in Splunk Phantom

When you first install Splunk Phantom, industry-standard indicator records are generated for events coming in. This can result in the generation of a large volume of indicator records many of which might not be necessary for your system. You can filter out certain indicators to decrease the number of indicator records that are generated.

Create a filter

To filter out certain indicators, follow these steps:

1. From the main menu, select Administration.
2. Select Event Settings > Indicators.
3. To filter out certain indicator records, uncheck the box by the field name of the record you don't want to generate indicators for. If you have created any custom CEF fields, by default those fields don't have indicator records. If you want to create indicators for these fields, make sure to check the box next to the field name.
4. After you have made any changes, click Save Changes.
5. (Optional) To sort by data type, click Data Type and choose how you would like to sort the fields. You can also search for indicators by data type in the search bar to add them to the filter.
6. (Optional) Click Field Type to sort the fields based on default or custom fields.
7. (Optional) Use the search bar to search for specific fields.
8. (Optional) Use the Total Count column to see the number of each type of indicator record across the system.

This filter applies only to events coming in after the filter is set and does not apply to indicator records that were previously created.