Splunk® Phantom (Legacy)

Install and Upgrade Splunk Phantom

Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.

General system requirements

Splunk Phantom requires certain minimum system requirements. Your environment must meet or exceed these requirements. This section details operating systems, web browsers, system storage, Linux file systems, and other requirements for operating Splunk Phantom.

Supported operating systems

Splunk Phantom supports these operating systems and versions:

  • Red Hat Enterprise Linux 7.6 through 7.9
  • CentOS 7.6 through 7.9

As a rule of thumb, Splunk Phantom generally supports the most recent minor version of a Red Hat Enterprise Linux or CentOS 7 operating system.

Supported browsers

Splunk Phantom requires a web browser that supports HTML 5, SVG graphics, and TLS.

Use the latest, fully patched version of one of the following browsers:

  • Google Chrome
  • Mozilla Firefox
  • Microsoft Edge
  • Apple Safari

Supported file systems and required directories

Splunk Phantom supports any file system where the user account running the application can be given write permissions.

In a clustered environment, Splunk Phantom implements GlusterFS for its file shares. If your organization requires a different file system for your Splunk Phantom cluster, make sure that the user account running Splunk Phantom has write permissions to the required directories.

Required directories for a standard installation:

  • /opt/phantom/apps
  • /opt/phantom/bin (spawn and spawn3 daemons)
  • /opt/phantom/local_data/app_states
  • /opt/phantom/scm
  • /opt/phantom/vault
  • /opt/phantom/tmp/shared

Required directories for an installation as an unprivileged user:

  • <phantom_install_dir>/apps
  • <phantom_install_dir>/local_data/app_states
  • <phantom_install_dir>/scm
  • <phantom_install_dir>/vault
  • <phantom_install_dir>/tmp/shared

File permissions

Splunk Phantom is installed:

  • On a privileged deployment - /opt/phantom
  • On an unprivileged OVA or AMI deployment - /opt/phantom, also called <PHANTOM_HOME>.
  • On an unprivileged deployment - the home directory of the user account that will run Splunk Phantom, also called <PHANTOM_HOME>.

Splunk Phantom expects a umask of 0022 during installation. Applying a different umask may lead to unexpected behavior.

In general, you should not modify file permissions for Splunk Phantom. Changing the file permissions can cause errors, or prevent Splunk Phantom from working.

You can check to see if an access control list has been applied using the Linux getfacl command, clear any access control list which is incorrectly being applied using the setfacl -b command, or apply correct permissions to a file with the chmod command. If you have changed file permissions, you will need to restart Splunk Phantom.

Directory Permissions
Owner Group Notes
/opt/phantom drwxr-xr-x 755 phantom phantom This is the default Splunk Phantom 'root' directory.
On an unprivileged deployment, it changes to be the user account that runs Splunk Phantom.
Referred to as <PHANTOM_HOME> in the documentation.
/opt/phantom/apps drwxrwxr-x 775 phantom phantom Required to allow the web-based UI to install apps.
Apps installed by the web-based UI will be owned by nginx in the phantom group.
/opt/phantom/local_data drwxrwxr-x 775 phantom phantom


drwxrwxr-x 775 phantom phantom
/opt/phantom/scm drwxrwx--- 770 phantom phantom Allows for non-nginx users of to have write access to playbooks.
/opt/phantom/spool drwxrwxr-x 775 phantom phantom Allows the nginx user of the phantom group to have access to create items, such as the uwsgi sub-directory.
/opt/phantom/tmp drwxrwx--- 770 phantom phantom Allows non-root users of the phantom group to have write access.
/opt/phantom/vault drwxrwxr-x 775 phantom phantom Allow non-phantom user of phantom group, such as the nginx user, to have the write access to add the file to vault, to create reports, and so on.
/opt/phantom/var/log drwxr-xr-x 755 phantom phantom Allows the web-based UI and other tools to create and write log files for Splunk Phantom actions. You should not modify the permissions for this directory. If logs cannot be written, app installation or other actions may fail.

On a privileged deployment, logging is done in /var/log/phantom/.



-rw-rw-r-- 664 phantom phantom Allows the web-based UI to write to the app_install.log and other tools to read it. You should not modify the permissions for this file. If this log cannot be written to, the Splunk Phantom web-based UI displays the error message "internal server error."

On a privileged deployment, logging is done in /var/log/phantom/.

Last modified on 15 September, 2021
Uninstall Splunk Phantom   System requirements for evaluation use

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters