What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

Question

Sullivan Dabireau · Accepted Answer

Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.

Sullivan Dabireau · Answer

Include the notable event's event_id field and set the artifacts label to aplunk notable event id.

Sullivan Dabireau · Answer

Rename the event_id field from the notable event to splunkNotableEventld.

Sullivan Dabireau · Answer

Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.

List of questions