Splunk Phantom SOAR Vault tmp Directory Clean Up

splunk4days — Tue, 05 Dec 2023 19:45:51 GMT

Hello,

In short, I have to transmute a file, and I leverage the /vault/tmp/ directory.

I'm able to do what I want, but I'm wondering if I have to 'clean up' this /vault/tmp/ directory.

ex - I have a file I want to XOR bit by bit. I read unxord.exe bit by bit, write to /vault/tmp/xord.exe, then I do a phantom.vault_add(file_location="/vault/tmp/xord.exe"). This works fine.

Do I have to do any removal of the "/vault/tmp/xord.exe"?

I've tried to do something like:

import os

os.remove("/vault/tmp/xord.exe")

However, I get a path not found error.

So, how often does Phantom SOAR clean up the /vault/tmp/ directory, and can/should I remove the temp file myself?

Thanks!

Re: Splunk Phantom SOAR Vault tmp Directory Clean Up

phanTom — Wed, 06 Dec 2023 08:43:30 GMT

@splunk4days i believe that by using the phantom.vault_add() API the file is "moved" from the tmp dir into the relevant file location on the platform where the vault storage is, rather than copied.

I have not tested this but have also never had to clear the /tmp dir when using it for vault_add() API calls.

topic Splunk Phantom SOAR Vault tmp Directory Clean Up in Splunk SOAR

Splunk Phantom SOAR Vault tmp Directory Clean Up

Re: Splunk Phantom SOAR Vault tmp Directory Clean Up