SPLK-2003

What is the main purpose of using a customized workbook?

First post and replies  | Last post by Giovanni, 4 months ago

Which of the following will show all artifacts that have the term results in a filePath CEF value?

First post and replies  | Last post by Jacques, 4 months ago

What values can be applied when creating Custom CEF field?

First post and replies  | Last post by Esteban, 4 months ago

Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

First post and replies  | Last post by Eldridge, 4 months ago

How can an individual asset action be manually started?

First post and replies  | Last post by Wilber, 4 months ago

Which is the primary system requirement that should be increased with heavy usage of the file vault?

First post and replies  | Last post by Arden, 4 months ago

What is enabled if the Logging option for a playbook's settings is enabled?

First post and replies  | Last post by Rolando, 4 months ago

Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

First post and replies  | Last post by Antwan, 4 months ago

Which of the following is a best practice for data sharing across playbooks?

First post and replies  | Last post by Orval, 5 months ago

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches.

First post and replies  | Last post by Guillermo, 5 months ago

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

First post and replies  | Last post by Galen, 5 months ago

Which of the following applies to filter blocks?

First post and replies  | Last post by Arden, 5 months ago

What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

First post and replies  | Last post by Arden, 5 months ago

During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?

First post and replies  | Last post by Carrol, 5 months ago

An active playbook can be configured to operate on all containers that share which attribute?

First post and replies  | Last post by Rolando, 5 months ago

Which of the following are examples of things commonly done with the Phantom REST APP

First post and replies  | Last post by Marshall, 5 months ago

What other user authentication method is supported?

First post and replies  | Last post by Guillermo, 5 months ago

Configuring Phantom search to use an external Splunk server provides which of the following benefits?

First post and replies  | Last post by Nathaniel, 5 months ago

Which of the following can be configured in the ROl Settings?

First post and replies  | Last post by Colton, 5 months ago

Which steps will accomplish the?

First post and replies  | Last post by Philip, 5 months ago

Within the 12A2 design methodology, which of the following most accurately describes the last step?

First post and replies  | Last post by Wilber, 5 months ago

On a multi-tenant Phantom server, what is the default tenant's ID?

First post and replies  | Last post by Rayford, 5 months ago

What is the cause of this behavior?

First post and replies  | Last post by Rueben, 6 months ago

Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

First post and replies  | Last post by Octavio, 6 months ago

What is the default embedded search engine used by Phantom?

First post and replies  | Last post by Rolando, 6 months ago

Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

First post and replies  | Last post by Vicente, 6 months ago

Without customizing container status within Phantom, what are the three types of status for a container?

First post and replies  | Last post by Mario, 6 months ago

Is it possible to import external Python libraries such as the time module?

First post and replies  | Last post by Lloyd, 6 months ago

After enabling multi-tenancy, which of the Mowing is the first configuration step?

First post and replies  | Last post by Ezequiel, 6 months ago

What are indicators?

First post and replies  | Last post by Rashad, 6 months ago