https://community.splunk.com/t5/Splunk-SOAR/Run-playbook-individually-against-artifacts/m-p/697032#M1541 <P>Hi all,&nbsp;</P><P>I am integrating a Splunk form/dashboard with SOAR, where I use "sendtophantom" to create a container on which a playbook needs to run.&nbsp;</P><P>However, what I am noticing is that when the container has multiple artifacts, the playbook takes all the artifacts' CEF fields and combines them into one, which then causes havoc with my playbooks. I have considered changing the ingest settings to send MV fields as a list instead of creating new artifacts, but this will break too many other playbooks, so it isn't an option right now.&nbsp;</P><P>My flow is basically as follows:&nbsp;</P><UL><LI>Container gets created with information coming from splunk</LI><LI>artifact(s) contain subject and sender email information</LI><LI>Playbook needs to run through each artifact to get the subject and sender info&nbsp;</LI><LI>Playbook processes these values</LI></UL><P>Is there a way to specify that a playbook must run against each artifact in a container individually, or another way to alter the datapaths in the VPE to run through each artifact?&nbsp;</P> Thu, 22 Aug 2024 07:06:28 GMT DavidvW 2024-08-22T07:06:28Z https://community.splunk.com/t5/Splunk-SOAR/Run-playbook-individually-against-artifacts/m-p/697032#M1541 <P>Hi all,&nbsp;</P><P>I am integrating a Splunk form/dashboard with SOAR, where I use "sendtophantom" to create a container on which a playbook needs to run.&nbsp;</P><P>However, what I am noticing is that when the container has multiple artifacts, the playbook takes all the artifacts' CEF fields and combines them into one, which then causes havoc with my playbooks. I have considered changing the ingest settings to send MV fields as a list instead of creating new artifacts, but this will break too many other playbooks, so it isn't an option right now.&nbsp;</P><P>My flow is basically as follows:&nbsp;</P><UL><LI>Container gets created with information coming from splunk</LI><LI>artifact(s) contain subject and sender email information</LI><LI>Playbook needs to run through each artifact to get the subject and sender info&nbsp;</LI><LI>Playbook processes these values</LI></UL><P>Is there a way to specify that a playbook must run against each artifact in a container individually, or another way to alter the datapaths in the VPE to run through each artifact?&nbsp;</P> Thu, 22 Aug 2024 07:06:28 GMT https://community.splunk.com/t5/Splunk-SOAR/Run-playbook-individually-against-artifacts/m-p/697032#M1541 DavidvW 2024-08-22T07:06:28Z