Splunk® Phantom (Legacy)

Administer Splunk Phantom

Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.

Configure the ROI Settings dashboard

Configure the parameters used to estimate the data displayed in the Automation ROI Summary dashboard.

Setting Description
FTE Gained Enable this toggle make the FTE Gained widget available in the Automation ROI Summary dashboard.


To calculate this value, Splunk Phantom divides the number of actions run by automation (calculated in Splunk Phantom) by the number of expected actions an analyst would take, based on minutes per action and analyst hours per day (configured on the ROI settings page).

Time Saved Enable this toggle make the Time saved widget available in the Automation ROI Summary dashboard.


To calculate this value, Splunk Phantom sums the difference between the Analyst Minutes Per Action (configured on the ROI settings page) and the actual minutes per action (calculated in Splunk Phantom) over all actions for the past 24 hours.

Money Saved Enable this toggle make the Dollars saved widget available in the Automation ROI Summary dashboard.


To calculate this value, Splunk Phantom multiplies the average time an analyst spends per action and the average analyst salary (configured on the ROI settings page) by the number of actions run by automation (calculated in Splunk Phantom).

Annual analyst salary The average annual salary paid to each analyst.
Currency The national currency value you want to use in the display.
Analyst hours per day The typical number of hours each analyst works per day.
Minutes per action The average number of minutes an analyst typically spends on any action in a case.

Use the Splunk App for Phantom Reporting to view more granular breakdowns of individual action runtimes. The Splunk App for Phantom Reporting sends Splunk Phantom log data back to the Splunk platform. You can use this data to generate or modify reports as needed.

The Splunk App for Phantom Reporting is not supported by Splunk. See App support types in Working with Splunkbase.

Last modified on 15 April, 2020
Configure your company settings in Splunk Phantom   Obtain and configure a Splunk Phantom license

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8, 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters