Splunk® Phantom (Legacy)

Administer Splunk Phantom

Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.

Filter indicator records in Splunk Phantom

When you first install Splunk Phantom, industry-standard indicator records are generated for events coming in. This can result in the generation of a large volume of indicator records many of which might not be necessary for your system. You can filter out certain indicators to decrease the number of indicator records that are generated.

Create a filter

To filter out certain indicators, follow these steps:

  1. From the main menu, select Administration.
  2. Select Event Settings > Indicators.
  3. To filter out certain indicator records, uncheck the box by the field name of the record you don't want to generate indicators for. If you have created any custom CEF fields, by default those fields don't have indicator records. If you want to create indicators for these fields, make sure to check the box next to the field name.
  4. After you have made any changes, click Save Changes.
  5. (Optional) To sort by data type, click Data Type and choose how you would like to sort the fields. You can also search for indicators by data type in the search bar to add them to the filter.
  6. (Optional) Click Field Type to sort the fields based on default or custom fields.
  7. (Optional) Use the search bar to search for specific fields.
  8. (Optional) Use the Total Count column to see the number of each type of indicator record across the system.

This filter applies only to events coming in after the filter is set and does not apply to indicator records that were previously created.

Last modified on 09 April, 2020
Create custom fields to filter Splunk Phantom events   Track information about an event or case using HUD cards

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters