A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in…

The correct answer is B. TCP 80 and TCP 443. To integrate Splunk Phantom with a Splunk Cloud instance, network communication over certain ports is necessary. The default ports for web traffic are TCP 80 for HTTP and TCP 443 for HTTPS. Since Splunk Cloud instances are accessed over the internet, ensuring that these ports…

Splunk SOAR Environment

Question

A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.

Options

ATCP 8088 and TCP 8099.
BTCP 80 and TCP 443.
CSplunk Cloud is not supported.
DTCP 8080 and TCP 8191.

How the community answered

(22 responses)

B
91% (20)
C
5% (1)
D
5% (1)

Explanation

To integrate Splunk Phantom with a Splunk Cloud instance, network communication over certain ports is necessary. The default ports for web traffic are TCP 80 for HTTP and TCP 443 for HTTPS. Since Splunk Cloud instances are accessed over the internet, ensuring that these ports are open is essential for Phantom to communicate with Splunk Cloud for various operations, such as running searches, sending data, and receiving results. It is important to note that TCP 8088 is typically used by Splunk's HTTP Event Collector (HEC), which may also be relevant depending on the integration specifics.

Topics

#Splunk Cloud#network ports#external Splunk#integration

Community Discussion

No community discussion yet for this question.

Full SPLK-2003 Practice