The default embedded search engine used by Splunk SOAR (formerly known as Phantom) is the embedded Splunk search engine. Here's a detailed explanation:
* Embedded Splunk Search Engine:
* Splunk SOAR uses an embedded, preconfigured version of Splunk Enterprise as its native search engine.
* This integration allows for powerful searching capabilities within Splunk SOAR, leveraging Splunk's robust search and indexing features.
* Search Configuration:
* While the embedded Splunk search engine is the default, organizations have the option to configure Splunk SOAR to use a different Splunk Enterprise deployment or an external Elasticsearch instance.
* This flexibility allows organizations to tailor their search infrastructure to their specific needs and existing environments.
* Search Capabilities:
* The embedded Splunk search engine enables users to perform complex searches, analyze data, and generate reports directly within the Splunk SOAR platform.
* It supports the full range of Splunk's search processing language (SPL) commands, functions, and visualizations.
* References:
* Splunk SOAR Documentation: Configure search in Splunk Phantom1.
* Splunk SOAR Documentation: Configure search in Splunk SOAR (On-premises)2.
In summary, the embedded Splunk search engine is the default search engine in Splunk SOAR, providing a seamless and powerful search experience for users within the platform. #