Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.
Add a note in
Add a general note using the /note command in . Only general notes are supported.
Use the following format:
/note "<title>" <note body>
You can use a datapath with a note to add additional information to a note. See Use a datapath in . This is shown in the following example:
/note "Attackers" Based on geolocate ip, attacks originated from artifact:*.ip
The above example results in a note added with the title "Attackers" and a body that looks like the following:
Based on geolocate ip, attacks originated from [2.2.2.2, 1.1.1.1]
Notes and datapaths
You can use a datapath anywhere in a note title or body. The datapath is evaluated as a Python style list, and creates a single note with the results listed in it.
See Use a datapath in .
Last modified on 07 September, 2021
| Run a playbook in | Update or edit an event in |
This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8, 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7
Download manual
Feedback submitted, thanks!