topic Re: Container data vs Custom Application Results in Splunk SOAR

Container data vs Custom Application Results

scorsatto — Thu, 10 Nov 2022 17:40:09 GMT

I'm creating a custom application in SOAR and one of the fields this custom application provides is a password information, for obvious reasons, I don't want to store the password in the container, rather I just would like to add it in a parameter that I can use during playbook execution only. is there any way I can do it?

Version: Splunk SOAR 5.2.1.78411

What I'm doing today in my custom app is:

if secret_value:
          self.save_progress("Secret value retrieved successfully")
          action_result.add_data({"succeeded": True, "secret_value": secret_value})
         return action_result.set_status(phantom.APP_SUCCESS, 'Successfully retrieved secret value')

but the secret value is saved in the container.

Re: Container data vs Custom Application Results

phanTom — Fri, 11 Nov 2022 09:10:37 GMT

@scorsatto if you add to action_results then it will be included in the JSON added to the container and there is no real way around it. You could hash it and then decode in the playbook when you need it?

I would like to understand what the app does a bit more as to why you would pass a secret out for playbook use when you can just create an app and use it in a playbook and keep the secret/password in the app config where it's already hidden.

Re: Container data vs Custom Application Results

scorsatto — Fri, 11 Nov 2022 12:15:18 GMT

Hello @phanTom, the app will be used to retrieve secrets from another tool like passwordVault, if there is no other alternative, I think I'll have to hash the password to avoid any exposures.

Re: Container data vs Custom Application Results

phanTom — Fri, 11 Nov 2022 13:08:11 GMT

@scorsatto if you are using either CyberArk/Hashicorp/Thycotic then the platform already supports that for application assets to be able to retrieve the password(s) from a vault for one time use only.

If you are not using any of the above then I think the hashing is your best way.

-- If this resolved your issue please mark as a Solution! Happy SOARing --

Re: Container data vs Custom Application Results

scorsatto — Fri, 11 Nov 2022 13:30:36 GMT

yup, I'll need to use a hashing.. I would be great to have this such functionality in the app development, like a new command to pass the results only without save the data to the container.

Thanks @phanTom for your help!