Which of the following describes the use of labels m Phantom?
After a successful POST to a Phantom REST endpoint to create a new object what result is returned?
Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?
How can more than one user perform tasks in a workbook?
How is a Django filter query performed?
What values can be applied when creating Custom CEF field?
A customer wants to design a modular and reusable set of playbooks that all communicate with each other. Which of the following is a best practice for data sharing across playbooks?
Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?
A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.
On a multi-tenant Phantom server, what is the default tenant's ID?
Configuring SOAR search to use an external Splunk server provides which of the following benefits?
Which of the following will show all artifacts that have the term results in a filePath CEF value?
How can a child playbook access the parent playbook's action results?
A user wants to get the playbook results for a single artifact. Which steps will accomplish the?
Where can the Splunk App for SOAR Export be downloaded from?
How does a user determine which app actions are available?
What is the default log level for system health debug logs?
Which Phantom VPE Nock S used to add information to custom lists?
Which of the following are examples of things commonly done with the Phantom REST APP
Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?
In a playbook, more than one Action block can be active at one time. What is this called?
Which of the following is a best practice for use of the global block?
Which of the following supported approaches enables Phantom to run on a Windows server?
How can the DECIDED process be restarted?
Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?
Why does SOAR use wildcards within artifact data paths?
When analyzing events, a working on a case, significant items can be marked as evidence. Where can ail of a case's evidence items be viewed together?
After a playbook has run, where are the results stored?