Splunk App for SOAR intermittently failed creating SOAR containers

Applicability

Description

Events were not being created in SOAR when using "Send to SOAR" Adaptive Response Action in the saved search. 

Investigation

To identify the error message that occurs when sending modalert, run search below:

index=cim_modactions source=*opt/splunk/var/log/splunk/phantom_sendtophantom_modalert.log

The following error can be seen:

024-10-25 20:08:02,619 ERROR pid=2430949 tid=MainThread file=cim_actions.py:message:436 | sendmodaction - worker=sh*.dns.splunkcloud.com signature="Unexpected error: [HTTP 403] Error talking to Splunk: GET /servicesNS/nobody/phantom/configs/conf-phantom: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/nobody/phantom/configs/conf-phantom?count=-1&output_mode=json." action_name="sendtophantom" search_name="Threat-*

From search below error code=5 was correlated when the issue started to occur.

index=_internal host=sh-*.dns.splunkcloud.com action=sendtophantom  source="/opt/splunk/var/log/splunk/splunkd.log" | timechart  span=1d count by code usenull=f

The following error can be seen:

+0000 WARN  sendmodalert [263678 AlertNotifierWorker-0] - action=sendtophantom - Alert action script returned error code=5

The capabilities of phantom_read, phantom_write, and admin_all_objects are required for  Splunk App for SOAR Export. Without these capabilities, the Splunk App for SOAR Export is not able to read or write the REST API key of the Splunk Phantom instance, therefore error : HTTP [403] will be observed.

Resolution

To remediate the issue, necessary roles and capacities needs to be present. 

1. In Splunk Web, navigate to Settings > Access Controls.
2. Click Users.
3. Click the name in use by the Splunk Phantom App for Splunk, such as Admin.
4. In the Assign to roles section, from the Available item(s) column, click phantom to add it to Selected item(s).
5. Click Save.

The capabilities of phantom_read, phantom_write, and admin_all_objects are required for Splunk App for SOAR Export.