skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-soar-automation-with-phantom

Implements Splunk SOAR playbooks automating alert triage, IOC enrichment, and incident containment.

954|172|Updated Mar 13, 2026
Search Tags:#playbook#incident response#Automation#SoC#soar#alert triage#splunk phantom
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-soar-automation-with-phantom
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-soar-automation-with-phantom
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/implementing-soar-automation-with-phantom
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-soar-automation-with-phantom

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC analysts spend excessive time manually triaging high-volume alerts, enriching IOCs, and coordinating response actions across disconnected security tools, leading to missed SLAs and inconsistent incident handling.

Core Features & Use Cases

  • Automated Phishing Triage: Extracts URLs, hashes, and IPs from ingested events, checks reputation via VirusTotal, blocks malicious indicators on Palo Alto firewalls, and creates ServiceNow tickets.
  • Universal Alert Enrichment: Enriches every incoming SIEM container with VirusTotal reputation, GeoIP, and WHOIS lookups before analyst review.
  • Human-in-the-Loop Containment: Adds approval gates via analyst prompts before high-impact actions like CrowdStrike host isolation or Active Directory account disabling.
  • Use Case: A phishing email reported through Splunk ES triggers a playbook that scores the URL across 90 engines, blocks it on the firewall, opens a ServiceNow incident, and prompts a Tier 2 analyst to isolate the affected workstation — reducing triage from 35 minutes to under 5.

Quick Start

Ask the assistant to build a Splunk SOAR phishing triage playbook that enriches URLs with VirusTotal and blocks confirmed malicious indicators on the firewall.

Frequently Asked Questions about implementing-soar-automation-with-phantom

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate phishing alert triage with Splunk SOAR?▼

Build a Phantom playbook that extracts URL, hash, and IP artifacts from ingested containers, runs reputation checks via the VirusTotal app, and blocks confirmed malicious indicators on the firewall. Trigger it on containers with phishing labels and high or medium severity.

How to add human approval before automated containment in SOAR playbooks?▼

Use phantom.prompt to present analysts with containment options like Isolate Host or Disable Account, with a response timeout. Define an explicit fallback branch for expired prompts so missed approvals do not leave threats unaddressed.

Why is my Splunk SOAR playbook not triggering on new events?▼

The most common cause is a label or severity mismatch between the playbook trigger conditions and the containers sent by Splunk ES. Verify the container's actual label and severity casing, confirm the playbook is active, and check the run_as account has action permissions.

What integrations does Splunk SOAR need for automated incident response?▼

Typical deployments configure app assets for VirusTotal (reputation), CrowdStrike (host isolation), Active Directory (account actions), Palo Alto (blocking), and ServiceNow (ticketing). Each asset stores API credentials and connection parameters in the SOAR configuration.

Why does phantom.act silently fail in my playbook?▼

Action names are app-specific and must match the configured asset exactly, such as url reputation versus url_reputation. Check the playbook run's debug and audit logs to confirm each action reports success rather than just playbook completion.

Related Skills

Explore More Software Engineering Skills→
MHaggisMHaggis
471

Data Source Mapper

Map MITRE ATT&CK techniques to data sources across SIEM schemas.

Community
Intermediate
automateyournetworkautomateyournetwork
627

slack-incident-workflow

Manage network incident response workflows within Slack.

Community
Advanced
jassicsjassics
6

alert-triage

Automate SIEM/EDR alert triage with validation, enrichment, and verdict decisions.

Community
Intermediate
AxxxxxxaaannAxxxxxxaaann

automating-ioc-enrichment

Enrich raw indicators of compromise with multi-source threat intelligence context.

Community
Advanced