Configure labels to apply to containers

Labels are a property applied to containers. A label applied to a container enables Splunk Phantom to run playbooks and other automation against containers.

Splunk Phantom ships with one label defined: events. More labels can be added to suit your workflow or organizational needs. Labels can have additional custom fields, be used as the basis of a HUD Card, or have tags required before the label's container can be set to a closed or resolved status.

Create a label

Perform the following steps to create a label:

1. From the main menu, select Administration.
2. Click Event Settings > Label Settings.
3. Click + Label.
4. Type a name for the label.
5. Click Create.

When creating labels, verify that the label permissions allow your users or profiles access to the new label if needed:

1. See Add a role to .
2. See the step regarding Label Permissions to configure label permissions for this role.

Delete or modify a label

Delete a label by clicking the ⓧ icon to the right of the label's name.

Perform the following tasks to modify a label:

1. From the main menu, select Administration.
2. Click Event Settings > Label Settings.
3. Click the label's name in the list.
4. Click either Custom Fields, HUD, or Resolution. Each of these items behaves identically to the top-level settings of the same name.
   • For Custom Fields settings, see Create custom fields for containers.
   • For HUD settings, see Track information about an event or case using HUD cards.
   • For Resolution settings, see Configure how events are resolved.