topic Re: How to pass data from one playbook to its subplaybook in Splunk SOAR

How to pass data from one playbook to its subplaybook

ansusabu — Sun, 07 Jun 2020 17:38:42 GMT

How can we pass data from one playbook to its sub playbook?

Re: How to pass data from one playbook to its subplaybook

cblumer_splunk — Wed, 30 Sep 2020 01:54:55 GMT

There are two good methods for passing data between playbooks in Phantom, and many other ways to use external databases /services/or APIs to pass data between playbooks and containers. These are the built-in methods:

Phantom App - 'Add Artifact' action
https://my.phantom.us/4.5/docs/app_reference/phantom_phantom#add-artifact
https://my.phantom.us/4.5/docs/automation/api_container#add_artifact

This method can be used to store (JSON formatted) data within a newly created Artifact either in the Container the playbook is being executed on at the time, or any Container across the local system as long as the ID is known. You can also create a new Container on any other connected Phantom instance as well, as long as the required App Asset is created and configured with the connection details on the local instance. Best used for data that should be stored long-term.

phantom.save_object()
https://my.phantom.us/4.5/docs/automation/api_data_management#save_object

"This API allows you to save data by key and/or container_id and/or playbook name, to be retrieved when executing playbooks on containers. Users can save a key and value pair along with the context of container id and/or playbook name."

Best used for data which can be deleted when the given container is closed using the 'clear_object' field:

"[optional] Defaults to False. If set True, the data will be deleted when the container is closed. The clear_object can be used to delete the data. If set True, container_id must be provided."

Re: How to pass data from one playbook to its subplaybook

diogofgm — Wed, 28 Aug 2019 17:37:28 GMT

what do you mean playbook and subplaybook? is this regarding ansible?

Re: How to pass data from one playbook to its subplaybook

cblumer_splunk — Wed, 28 Aug 2019 17:44:03 GMT

Phantom playbooks. It is recommended to use a Module Design (Parent & Children) when creating SOAR use cases with Phantom.

https://my.phantom.us/4.5/docs/vpe/editor#playbook
https://my.phantom.us/4.5/docs/automation/api_playbook#playbook

My answer will be posted here shortly.

Re: How to pass data from one playbook to its subplaybook

diogofgm — Wed, 28 Aug 2019 18:00:33 GMT

sorry. its was not tagged as phantom xP

Re: How to pass data from one playbook to its subplaybook

cblumer_splunk — Wed, 30 Sep 2020 02:07:32 GMT

Other available methods:

phantom.get_action_results()
https://my.phantom.us/4.5/docs/automation/api_data_access#get_action_results
phantom.add_note() & phantom.get_notes()
https://my.phantom.us/4.5/docs/automation/api_container#add_note
https://my.phantom.us/4.5/docs/automation/api_container#get_notes
HTTP App for Phantom - 'get data' action - '/rest/action_run' endpoint
https://my.phantom.us/4.5/docs/app_reference/phantom_http#get-data
https://my.phantom.us/4.5/docs/rest/query

Re: How to pass data from one playbook to its subplaybook

ankitsync — Wed, 31 Mar 2021 04:12:54 GMT

Hi there,

I have implemented the artifact creation way of sharing data with multiple playbooks on the same container. It works perfect when run in debug mode both with scope new and all. But when the playbook is made active, the actions on the playbook can't read those artifacts as the default scope when a playbook is set to active is 'new'. Please help how can we set the scope global for entire playbook when in active mode.

BR,

Ankit

Re: How to pass data from one playbook to its subplaybook

phanTom — Wed, 31 Mar 2021 08:09:35 GMT

@ankitsync the only way to change the scope of a playbook is to run it using REST as you can set the scope in the call:

https://docs.splunk.com/Documentation/Phantom/4.9/PlatformAPI/RESTPlaybook

There is also the option of setting the scope of the point of collection (collect2, etc) in the other playbook by adding scope='all' to the relevant call. Check the docs for which ones have the capability. A few are collect2, format, condition, decision, and many more.

https://docs.splunk.com/Documentation/Phantom/4.9/PlaybookAPI/DataAccessAPI#collect2

NOTE: By changing the scope setting in a default API call it will change the block to a 'custom' block, so be aware of that when/if using this method.

Re: How to pass data from one playbook to its subplaybook

ankitsync — Wed, 31 Mar 2021 08:19:34 GMT

Hi , Thanks for sharing I did research about both these methods. While the custom a parameter addition to blocks is something i have kept in mind as a last resort. Is there a way to make that rest call from another playbook ?

Re: How to pass data from one playbook to its subplaybook

phanTom — Wed, 31 Mar 2021 08:27:18 GMT

@ankitsync you can either:

1. Use the phantom APIs phantom.build_phantom_rest_url() & phantom.requests() to run RESTS calls in Phantom playbooks. You can use in either of the custom function types.
https://docs.splunk.com/Documentation/Phantom/4.10/PlaybookAPI/SessionAPI

2. You can use the HTTP app in playbooks to speak with Phantom REST. This is sometimes better as there is no custom code required but can require a few format blocks to make the url & any payload for POST actions and needs an asset configured for the App.

https://my.phantom.us/4.10/docs/app_reference/phantom_http