topic Re: Phantom double Parameters when send email in Splunk SOAR

Phantom double Parameters when send email

bviehmann — Wed, 12 Dec 2018 10:57:02 GMT

hello I scan systems with nessus on vulnerbilities and send them to splunk.

With phantom I could generate emails. An event is a system for me and the vulnerbilities are the artifacts. When i send an email then some parameters will come up double .... how can i change that?

here an example:

Guten Tag Herr Tobias, Tobias

Betroffene Plattform
IP: 10.11.12.13, 10.11.12.13
Hostname: 244.abc.de, 244.abc.de

Sicherheitsrisiko: high, high

80/TCP, 443/TCP
blabla,

Lösungsvorschlag:
Unknown at this time., Unknown at this time

Re: Phantom double Parameters when send email

rsantoso_splunk — Tue, 19 Mar 2019 04:24:39 GMT

Hi bviehmann,

I assume you use the format Template to fill in your email body?
How is the template and parameters look like?

Please check the format block documentation if you not already have:
https://my.phantom.us/4.1/docs/vpe/editor#format

Re: Phantom double Parameters when send email

bviehmann — Wed, 20 Mar 2019 13:24:10 GMT

Hi @rsantoso_splunk
yes i use the format Template .... in the documentation i dont find anythin about my problem ..(

Re: Phantom double Parameters when send email

bviehmann — Wed, 20 Mar 2019 13:25:50 GMT

@rsantoso_splunk here is an example from my playbook

Re: Phantom double Parameters when send email

rsantoso_splunk — Mon, 25 Mar 2019 02:43:02 GMT

@bviehmann, please check your artifact's event to see either of the following?
1. The Artifact deviceAddress contains two address 10.11.12.13, 10.11.12.13 Or
2. There are two Artifacts that contain the same address 10.11.12.13

Re: Phantom double Parameters when send email

cblumer_splunk — Wed, 30 Sep 2020 02:00:04 GMT

For your Use Case you will most likely want to use the Format Block's _as_list feature:
https://my.phantom.us/4.5/docs/automation/api_playbook#format

You Format Block template can look like this:

Use this DataPath to pass the full output of the Format Block to the 'body' parameter of the Send Email action block:
format_1:formatted_data

And your Email Body will look like this: