Find the desired product help

Phantom Settings


  • Phantom is a security operations platform that helps customers streamline workflows to improve efficiency and precision. The Phantom settings area lets you integrate SOCaaP with your Phantom account. SOCaaP can then pass SOCaaP incidents and event information to Phantom.

To open the 'Phantom Settings' interface

  • Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'



Phantom Settings - Table of Column Descriptions

Column Header

Description

Name

Name of the phantom account.

Authentication Token

 Unique key generated to authenticate your Phantom account to SOCaaP.

Server

Enter phantom server details.

Severity

Select the severity level of incidents that are being pushed to phantom account.

  • Low
  • Medium
  • High
  • Dynamic

Sensitivity

 Color coded indicator for the incident. You configure the sensitivity in the 'Incident Category Management' interface.

Tags

 Enter keywords which describe the Phantom account's purpose.

Expires in hours

 The length of time remaining on the current session.

To assign 'Phantom Action', to an incident:
  • Click the 'Hamburger' icon > Incidents > Category Action Management
  • Click 'Add'




The 'Add Category Action' dialog will open.

  • Select the incident status from the 'Status' drop-down
  • Select 'Phantom Action' from the 'Type' drop-down
  • Choose the phantom account you want your incident to be pushed to from the 'Phantom Rest Configs' drop-down



The phantom settings configured will populate based on the account you select. See Category Action Management for more details.


The 'Phantom Settings' screen will open. Please see below links to learn more:


Add phantom account

  • Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'
  • Click 'Add' on the bottom right of the interface. The 'Add Phantom Config' interface will open




  • Enter the required fields and click 'Save'
  • The Phantom account will be added and you can view the details listed in the 'Phantom Settings' interface
  • If you want to add a phantom action for an incident, select 'Phantom action' in actions field. See Category Action Management for more details.
Edit phantom account
  • Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'
  • Select the phantom account that you want to edit and click the 'Edit' button on the bottom right of the interface. The 'Edit Phantom Config' interface will open



  • Modify the required fields and click 'Save'

The modified account will be saved.


Delete phantom account

  • Click the 'Hamburger' icon > 'Administration' > 'Phantom Settings'
  • Select the phantom account that you want to delete and click the 'Delete' button on the bottom right of the interface.

A confirmation dialog will open.



  • Click 'Yes' to remove the phantom account

Please note that the incident that are integrated with the account will also be removed.