It's time for some long-overdue changes to the Splunk apps that integrate Splunk SOAR into our Splunk Cloud and Enterprise offerings. Here's a quick summary:
- The Phantom App for Splunk will be renamed to Splunk App for SOAR Export
- The following three apps will be combined into one app and be called Splunk App for SOAR
This helps reduce confusion about what each app does and simplifies the installation and configuration process. And of course it's about time we moved on from calling things "Phantom" around here! To help remember the differences between the two apps, I find it helpful to think about it this way:
- Splunk App for SOAR Export - exports data from Splunk to SOAR
- Splunk App for SOAR - imports data from SOAR to Splunk
How are we going to combine those three apps into one app without making it a huge hassle? Glad you asked. If you currently have "Phantom Remote Search" installed, that app will update in-place with the name change and additional functionality from the other two apps. Users who have "Splunk Add-On for Phantom" or "Splunk App for Phantom Reporting" are encouraged to use the new Splunk App for SOAR as that will be the app receiving updates moving forward.
What do you think of these changes? If you have any questions, please leave a comment below!
— Matt Sayar, Product Manager, SOAR Apps
