SPLK-2003

How can this rule be applied?

First post and replies  | Last post by Randolph, 1 year ago

Which of the following is a step when configuring event forwarding from Splunk to Phantom?

First post and replies  | Last post by Ezequiel, 1 year ago

What is the main purpose of using a customized workbook?

First post and replies  | Last post by Giovanni, 2 years ago

Which of the following will show all artifacts that have the term results in a filePath CEF value?

First post and replies  | Last post by Jacques, 2 years ago

What values can be applied when creating Custom CEF field?

First post and replies  | Last post by Esteban, 2 years ago

Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

First post and replies  | Last post by Eldridge, 2 years ago

How can an individual asset action be manually started?

First post and replies  | Last post by Wilber, 2 years ago

Which is the primary system requirement that should be increased with heavy usage of the file vault?

First post and replies  | Last post by Arden, 2 years ago

What is enabled if the Logging option for a playbook's settings is enabled?

First post and replies  | Last post by Rolando, 2 years ago

Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

First post and replies  | Last post by Antwan, 2 years ago

Which of the following is a best practice for data sharing across playbooks?

First post and replies  | Last post by Orval, 2 years ago

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches.

First post and replies  | Last post by Guillermo, 2 years ago

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

First post and replies  | Last post by Galen, 2 years ago

Which of the following applies to filter blocks?

First post and replies  | Last post by Arden, 2 years ago

What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

First post and replies  | Last post by Arden, 2 years ago

During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?

First post and replies  | Last post by Carrol, 2 years ago

An active playbook can be configured to operate on all containers that share which attribute?

First post and replies  | Last post by Rolando, 2 years ago

Which of the following are examples of things commonly done with the Phantom REST APP

First post and replies  | Last post by Marshall, 2 years ago

What other user authentication method is supported?

First post and replies  | Last post by Guillermo, 2 years ago

Configuring Phantom search to use an external Splunk server provides which of the following benefits?

First post and replies  | Last post by Nathaniel, 2 years ago

Which of the following can be configured in the ROl Settings?

First post and replies  | Last post by Colton, 2 years ago

Which steps will accomplish the?

First post and replies  | Last post by Philip, 2 years ago

Within the 12A2 design methodology, which of the following most accurately describes the last step?

First post and replies  | Last post by Wilber, 2 years ago

On a multi-tenant Phantom server, what is the default tenant's ID?

First post and replies  | Last post by Rayford, 2 years ago

What is the cause of this behavior?

First post and replies  | Last post by Rueben, 2 years ago

Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

First post and replies  | Last post by Octavio, 2 years ago

What is the default embedded search engine used by Phantom?

First post and replies  | Last post by Rolando, 2 years ago

Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

First post and replies  | Last post by Vicente, 2 years ago

Without customizing container status within Phantom, what are the three types of status for a container?

First post and replies  | Last post by Mario, 2 years ago

Is it possible to import external Python libraries such as the time module?

First post and replies  | Last post by Lloyd, 2 years ago