Splunk® Phantom (Legacy)

Administer Splunk Phantom

Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.

Enable or disable registered mobile devices

You can allow users to register mobile devices and use Splunk mobile apps with your instance.

The Enable Mobile App toggle is disabled by default. Toggle this switch so that users see the Mobile Device Registration tab in their Account Settings and use it to register mobile devices. This toggle is available for viewing and editing if your role has basic permissions in the system settings with view and edit selected. See Manage roles and permissions in for more information about roles and permissions.

Enable mobile device registration with

Enable registration of mobile devices by doing the following:

  1. From the main menu, select Administration.
  2. Select Mobile.
  3. Toggle the Enable Mobile App switch to the On position.
  4. Click Confirm.

Disable mobile device registration with

Disable registration of mobile devices by doing the following:

  1. From the main menu, select Administration.
  2. Select Mobile.
  3. Toggle the Enable Mobile App switch to the Off position.
  4. Click Confirm.

When mobile device registration is disabled, traffic doesn't flow between and mobile devices, and the Mobile Device Registration tab is no longer visible in Account Settings.

When the mobile feature is re-enabled, previously registered devices can resume communication with .

View registered mobile devices

When the Enable Mobile App toggle is switched on, you can see all the mobile devices that are registered by users. You can see them as a list, or you can search for them by device name.

If users remove their own devices from their account settings, then the devices automatically disappear from this list. Users can also remove their registration from the Splunk Mobile app, and the devices also automatically disappear from this list. You can remove your registration only while the Enable Mobile App toggle is switched on. If the toggle is switched off, then the removal message is not received.


Remove registered mobile devices

When the Enable Mobile App toggle is switched on, you can remove a user's registered device.

If you delete a user account, Splunk Phantom removes the registration for all of the devices that belong to the user.

When you no longer want a user to have access to the mobile app from a particular mobile device, do the following to remove the registered device:

  1. Locate the device by its name in the table.
  2. In the Action column, click remove.
  3. When prompted, confirm by clicking remove.
Last modified on 07 September, 2021
Secure by configuring an account password expiration   Monitor the health of your system

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8, 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters