Splunk SOAR (f.k.a. Phantom)

Issue to Map fields between QRadar and Phantom

flogo
New Member

Hello,

I'm using the QRadar integration on Phantom, and we can define the mapping between Phantom and QRadar.
I got an issue when i tried to map fields, so the map works correctly for generic field (QID, username, sourceip, etc...) and Custom Fields that doesn't containing space character, for example "EventID". But when i tried to map custom field that contain a space character like "Domain Name", the mapping doesn't work.
Someone got the same issue than me ?

Thank you in advance,
Regards,
Florian

Labels (1)
Tags (3)
0 Karma

kyung123a
New Member

Comma separated list of field names. Shouldn't double quotes be used if the field name contains spaces?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...