Create and export data models and saved searches to send to Splunk Phantom or SOAR Cloud

You can create data models or saved searches to send data from the Splunk platform to Splunk Phantom or SOAR Cloud.

Differences between data models and saved searches

Data models and saved searches both let you organize data. However, there are a few differences.

Use a data model for the following use cases:

• To show hierarchy between your data sets
• To make data common across multiple datasets and devices
• To simplify complex datasets for end users
• When end user interaction is required

Use a saved search for the following use cases:

• To run scheduled reports
• When end user interaction is not required

Create a data model export to send data to Splunk Phantom or SOAR Cloud

To send data to Splunk Phantom or SOAR Cloud in the form of a data model export, follow these steps for guidance.

Before you create a data model export

Before you create a data model export, perform the following tasks:

• Set up a data model in your Splunk platform instance. For instructions on setting up a data model in your Splunk platform instance, see Design data models in the Splunk Enterprise Knowledge Manager Manual.
• Check that your data model has read permissions enabled so that the Splunk Phantom App for Splunk can discover your data models. See Manage data models in the Splunk Enterprise Knowledge Manager Manual.
• Make sure you have completed the steps in Steps to connect the Splunk platform with Splunk Phantom.

Create a data model export

To create a data model export in the Splunk Phantom App for Splunk, follow these steps:

1. Navigate to the Event Forwarding tab in the Splunk Phantom App for Splunk.
2. Click Add New.
3. Select Data Model Export.
4. In the Name field, enter a name for this event forwarding configuration.
5. From the drop-down list in the Data Model field, select the data model containing the data you want to send to Splunk Phantom. When a data model is selected, the search runs in the background. You can view the results of the data model search after completing the first page of the event forwarding configuration and clicking Next.
6. From the drop-down list in the Object field, select an object. Within a data model there are often various datasets, so selecting an object specifies the specific dataset you want to use to send data to Splunk Phantom.
7. In the Select Destination field, choose the Splunk Phantom server where you want to export your data model. Choose from the servers that you configured on the Phantom Server Configuration page. See Connect the Splunk Phantom App for Splunk and the Splunk Platform to a Splunk Phantom server.
8. (Optional) From the drop-down list in the Container Name field, select a field whose value is used to generate the container name in Splunk Phantom.
   • Select Auto-generate and do not select any Group fields on the next screen to create a container using the name of this forwarding event configuration. For example, if you entered fwconfig in the Name field, the container is created with the name fwconfig.
   • Select Auto-generate and one or more Group fields on the next screen to create a container using the name of this forwarding event configuration and the CEF field name and value for each selected Group field. For example, if you entered fwconfig in the Name field and on the next page select Group using sourceAddress, the container is created with a name such as fwconfig sourceAddress:10.11.12.13.
   • Select a specific CIM field in the Container Name field to create a container using the value of the selected field. For example, if you select the src_ip field which returns the value 10.11.12.13, the container is created with the name 10.11.12.13.
9. (Optional) Enter a container label in the Container Label field. This label must exist in the Splunk Phantom instance. For more information, see Troubleshoot event forwarding.
10. Create a schedule for the data model export. For the most optimized search, choose the shortest amount of time possible that does not consume a high amount of your available resources. The exact amount varies depends on your environment. By default it will be set to Every 5 Minutes.
11. Click Next.
12. (Optional) Click on the name of the data model search to open the search in a new tab. You can use this to validate your search results at any time.
13. Select the desired severity and sensitivity of the alert sent to Splunk Phantom or SOAR Cloud.
14. Configure unmapped fields. Select the field you want to map in the Search Fields column and map it to a CEF field in the CEF Fields column. Unmapped fields are ignored and not sent to Splunk Phantom or SOAR Cloud. Click the Group checkbox if you want artifacts with the same value to be grouped together in the same container. For example, if you want group all artifacts with the same value in the _time field, select the Group checkbox next to the _time field and make sure it has a corresponding CEF mapping. Use the drop-down list in the Contains column for additional filtering. For example, select ip in the Contains column for a source field so that only source fields containing an IP address are sent to Splunk Phantom or SOAR Cloud.
15. (Optional) Click Save Mappings to save your custom mappings as global field mappings. See Configure global field mappings.
16. Click on Mapped Fields to expand the section and verify the mappings. The Splunk Phantom App for Splunk automatically maps fields that it recognizes, or that are part of the global fields mappings. You can edit and of the field mappings as needed.
17. Click Save and Preview. If the preview looks correct, click Send to Phantom. This will send the individual event from the Splunk platform to Splunk Phantom or SOAR Cloud.
18. Click Save and Close to save and send your search results.

If you have configured your data model export correctly, a success message will appear with a link to your container.

Delete or clone your data model export

After you save your data model export, you can choose to delete or clone it by clicking the Delete or Clone buttons under the Actions column. Cloning your data model export can save time later if you choose to create a similar data model export.

Create a saved search export to send data to Splunk Phantom

To send data to Splunk Phantom or SOAR Cloud in the form of a saved search export, follow these steps for guidance.

Before you create a saved search export

Before you create a saved search export, perform the following tasks:

• Set up a saved search in your Splunk platform instance. For instructions on setting up a saved search, see Saving searches in the Splunk Search Manual.
• In the search, use the table command to view specific fields from the search. This is useful for troubleshooting in cases where a saved search does not have all the expected fields.
• Check that your saved search has read permissions enabled so that the Splunk Phantom App for Splunk can discover your saved searches.
• Make sure you have completed the steps in Steps to connect the Splunk platform with Splunk Phantom.

Create a saved search export

To create a saved search export in the Splunk Phantom App for Splunk, follow these steps:

1. Navigate to the Event Forwarding tab in the Splunk Phantom App for Splunk.
2. Click Add New.
3. Select Saved Search Export.
4. In the Name field, enter a name for this event forwarding configuration.
5. From the drop-down list in the Saved Search field, select the saved search containing the data you want to send to Splunk Phantom or SOAR Cloud. When a saved search is selected, the search runs in the background. You can view the results of the saved search after completing the first page of the event forwarding configuration and clicking Next.
6. (Optional) From the drop-down list in the Container Name field, select a field whose value is used to generate the container name in Splunk Phantom.
   • Select Auto-generate and do not select any Group fields on the next screen to create a container using the name of this forwarding event configuration. For example, if you entered fwconfig in the Name field, the container is created with the name fwconfig.
   • Select Auto-generate and one or more Group fields on the next screen to create a container using the name of this forwarding event configuration and the CEF field name and value for each selected Group field. For example, if you entered fwconfig in the Name field and on the next page select Group using sourceAddress, the container is created with a name such as fwconfig sourceAddress:10.11.12.13.
   • Select a specific CIM field in the Container Name field to create a container using the value of the selected field. For example, if you select the src_ip field which returns the value 10.11.12.13, the container is created with the name 10.11.12.13.
7. (Optional) In the Artifact Label field, select an artifact label to attach to the artifact in Splunk Phantom or SOAR Cloud.
8. In the Select Destination field, choose the Splunk Phantom server or SOAR Cloud destination where you want to export your saved search. Choose from the servers that you configured on the Phantom Server Configuration page. See Connect the Splunk Phantom App for Splunk and the Splunk Platform to a Splunk Phantom server.
9. (Optional) In the Container Label field, enter a label for the container. This label must exist in the Splunk Phantom or SOAR Cloud instance. If you don't see your container label, see Troubleshoot the Splunk Phantom App for Splunk.
10. Create a schedule for the saved search export. For the most optimized search, choose the shortest amount of time possible that does not consume a high amount of your available resources. The exact amount varies depends on your environment. By default it will be set to Every 5 Minutes. You can also use the Earliest Time and Latest Time fields to create a time window for the search. By default, the time window begins at twice the value in the Every field. For example, 5 minutes in the Every field means a starting window of -10 minutes. This value is reset each time you select a new value in the Every field, but you can specify any custom value after setting the value in the Every field. For example:
    • To set the Earliest Time to -14 minutes, change the Every field to 7 minutes.
    • To set the Earliest Time to -7 minutes, change the Every field to the desired value, then manually change the Earliest Time field to -7 minutes.
    See Time modifiers in the Splunk Enterprise Search Reference or more information about time windows.
11. Click Next.
12. (Optional) Click on the name of the saved search to open the search in a new tab. You can use this to validate your search results at any time.
13. Select the desired severity and sensitivity of the alert sent to Splunk Phantom.
14. Configure unmapped fields. Select the field you want to map in the Search Fields column and map it to a CEF field in the CEF Fields column. Unmapped fields are ignored and not sent to Splunk Phantom or SOAR Cloud. Click the Group checkbox if you want artifacts with the same value to be grouped together in the same container. For example, if you want group all artifacts with the same value in the _time field, select the Group checkbox next to the _time field and make sure it has a corresponding CEF mapping. Use the drop-down list in the Contains column for additional filtering. For example, select ip in the Contains column for a source field so that only source fields containing an IP address are sent to Splunk Phantom.
15. (Optional) Click Save Mappings to save your custom mappings as global field mappings. See Configure global field mappings.
16. Click on Mapped Fields to expand the section and verify the mappings. The Splunk Phantom App for Splunk automatically maps fields that it recognizes, or that are part of the global fields mappings. You can edit and of the field mappings as needed.
17. Click Save and Preview. If the preview looks correct, click Send to Phantom. This will send the individual event from the Splunk platform to Splunk Phantom or SOAR Cloud.
18. Click Save and Close to save and send your search results.

If you have configured your saved search export correctly, a success message appears with a link to your container.

Delete or clone your saved search export

After you save your saved search export, you can choose to delete or clone it by clicking the Delete or Clone buttons under the Actions column. Cloning your saved search export can save time later if you choose to create a similar saved search export.