Which Splunk user account roles must be created to configure Phantom with an external Splunk Enterprise instance?

• A. superuser, administrator
• B. phantomcreate, phantomedit
• C. phantomsearch, phantomdelete
• D. admin, user

Answer: (C)

The appropriate user account roles that must be created to configure Phantom with an external Splunk Enterprise instance are the roles that encompass search and delete permissions specific to Phantom's operational needs. In this context, phantomsearch and phantomdelete roles play a vital role in enabling Phantom to effectively interact with Splunk by ensuring it can retrieve necessary data and remove or update relevant data as required during its automation processes.

The phantomsearch role is crucial because Phantom needs the ability to query Splunk data in order to initiate its automated workflows based on the insights drawn from that data. Likewise, the phantomdelete role permits Phantom to manage data that is no longer necessary or needs to be removed, facilitating effective data governance and operational efficiency within the integrated systems.

Other user roles, such as superuser and administrator, may have broader permissions that are not specifically tailored to the actions Phantom needs to perform when operating with Splunk. Similarly, while roles like admin and user may suit general access needs, they do not provide the specific functionalities required for optimal integration and operations of Phantom with the Splunk Enterprise instance. Hence, focusing on the tailored access provided by phantomsearch and phantomdelete ensures a secure and efficient setup for the integration.