Skip to main content


Splunk Lantern

Getting help with Splunk SOAR


Splunk offers a number of EDU training courses to help you get up to speed on how to make the most of your deployment. Completion of these courses to some effect is an essential building block to success. If you’d like to explore education options here, please get in touch with us via this contact form or get in touch with your account manager.

Course Description
Developing Splunk SOAR playbooks This 9 hour introductory course prepares IT and security practitioners to plan, design, create and debug basic playbooks for Splunk SOAR. Students will learn fundamentals of Splunk SOAR playbook capabilities, creation and testing. This course is a pre-requisite for the Advanced Phantom Implementation course.
Splunk SOAR analyst queue walkthrough This 9-minute video shows you how to navigate, filter, edit, and take action on events in the Splunk SOAR Analyst queue.
Advanced Splunk SOAR implementation This three virtual-day course is intended for experienced Phantom consultants who will be responsible for complex Splunk SOAR solution development, and will prepare the attendee to integrate Splunk SOAR with Splunk as well as develop playbooks requiring custom coding and REST API usage.
Splunk SOAR automation broker This 24-minute walkthrough is for Splunk SOAR admins with basic networking knowledge who understand Splunk SOAR apps, assets, and actions. Students will learn the role of the automation broker in Splunk SOAR implementation, how to install, configure, and use the automation broker to run on-prem app actions, and how to troubleshoot issues.
Splunk SOAR mission control walkthrough This 7-minute video guides analysts in using Splunk SOAR with Mission Control.
Administering Splunk SOAR This course prepares IT and security practitioners to install, configure and use a Splunk SOAR server in their environment and will prepare developers to attend the playbook development course.
  • Was this article helpful?