Explanation
A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit only non-null IP addresses to pass forward to the next block. The !- operator means "is not null". The other options are not valid because they either include null values or other fields than sourceAddress. See Filter block for more details.

A user can determine which app actions are available by adding an action block to a playbook canvas area.
The action block will show a list of all the apps installed on the Phantom system and the actions supported by each app. The other options do not provide a comprehensive view of the app actions available. Reference, page 11. In Splunk Phantom, to determine which app actions are available, a user can add an action block to the playbook canvas area within the visual playbook editor. The action block will present a list of available apps and their associated actions that the user can choose from. This method provides a user-friendly way to browse and select from the various actions that can be incorporated into the automation workflows (playbooks). The visual playbook editor is a key component of Phantom, allowing users to design, edit, and manage playbooks via a graphical interface.

In Splunk SOAR, the appropriate role for an account that will only be used to execute automated tasks is the
"Automation" role. This service account role is specifically designed for automated tasks, including REST API operations, playbook execution, and ingestion. It is intended for use by systems rather than human users and provides the necessary permissions for automated interactions with the SOAR platform1.
References:Splunk SOAR documentation on managing roles and permissions1.
In Splunk SOAR, the "Automation" role is designed specifically for accounts that are intended for executing automated tasks. These tasks can include REST API operations, playbook actions, and data ingestion processes. The Automation role is a type of service account role intended for system-to-system interactions and is not meant to be used by human operators. It provides a tailored set of permissions that allows for the execution of automated processes without granting broader access that would be unnecessary or insecure for an automated account.
The designation of this role is critical in maintaining proper security and operational boundaries within the SOAR platform. By restricting the automated account to just the Automation role, Splunk SOAR ensures that automated processes run with the least privilege necessary, reducing the risk of unauthorized actions and maintaining a clear separation between human users and automated systems.

The Phantom App for Splunk allows a user to run Splunk queries from within Phantom. This app provides actions such as run query, ingest events, and save search, which enable the user to interact with Splunk from Phantom playbooks or the Phantom UI. The other apps are not relevant for this use case. The Splunk App for Phantom is used to send data from Splunk to Phantom. The Integrated Splunk/Phantom app is a deprecated app that was replaced by the Splunk App for Phantom. The Splunk App for Phantom Reporting is used to generate reports on Phantom activity from Splunk. The Phantom App for Splunk is the application that enables Splunk users to run Splunk queries from within the Splunk Phantom platform. This app integrates Splunk's data and search capabilities into Phantom's security automation and orchestration framework, allowing users to perform actions such as running searches, creating events, and updating records in Splunk directly from Phantom.