topic Phantom Custom Code Alarm in Splunk SOAR

Phantom Custom Code Alarm

johnteo — Sun, 07 Jun 2020 17:27:19 GMT

Hi guys I have been trying to make a alarm ring every time the playbook executes.

However, when trying to do it with Python in the VPE, and import error occurs when I try to import winsound (No module named winsound). I do not know how to resolve this error in the VPE.

Does the development environment here allow for the import of that module?

Re: Phantom Custom Code Alarm

ansusabu — Wed, 13 Nov 2019 07:51:54 GMT

You have to install the module in your server first,then try to import the module in the global block.

Re: Phantom Custom Code Alarm

rplas — Wed, 13 Nov 2019 14:07:29 GMT

You'll need to install that module either via pip on your Phantom server or bundled into a Phantom app.

To install a package, log into the command line of your Phantom server and run phenv pip2.7 install {package} where {package} is just the name of the package you want to install. For example, phenv pip2.7 install winsound.

Then you should be able to import winsound in the global section of the playbook.

Sources:

Re: Phantom Custom Code Alarm

rplas — Wed, 13 Nov 2019 14:11:50 GMT

However, I don't think this module will work as Phantom does not have access to your Windows environment.

Re: Phantom Custom Code Alarm

johnteo — Wed, 11 Dec 2019 07:53:30 GMT

Hi, I have returned to this problem again. I am able to install the package(playsound this time). However, if Phantom does not have access to my Windows Environment is it possible to play a sound from the mp3 file as I leave phantom running on the background?

Re: Phantom Custom Code Alarm

johnteo — Wed, 11 Dec 2019 08:19:10 GMT

May I know how to give Phantom access to the windows environment?

Re: Phantom Custom Code Alarm

johnteo — Wed, 11 Dec 2019 08:19:23 GMT

After importing the module onto the server successfully, how do i make the sound play every time the playbook runs?

Re: Phantom Custom Code Alarm

sam_splunk — Thu, 12 Dec 2019 01:22:41 GMT

Phantom runs on Linux, not Windows. You may be running Phantom on Linux on Windows (i.e. Phantom -> VirtualBox -> CentOS) but you'd need to get the underlying Linux system an audio device and driver. You cannot directly give it access to the windows audio subsystem.

You may be able to add a virtual sound device (if you're using vmware or virtualbox or the like) and then configure Linux to use that and play audio. If you get that working, you'll have to work out the right command(s) to play the sound and then build that into your playbook(s) (using something like ssh into the host).

Overall, this will be pretty complicated to do directly. Finding an API you can hit that plays a sound would likely be much easier.

Re: Phantom Custom Code Alarm

rgresham_splunk — Thu, 12 Dec 2019 06:19:38 GMT

@johnteo Just remember... what @rplas says is correct here for a development environment. However, I would always use link text process to deploy in a production environment because, the playbooks would fail if you have a warm standby or clustered environment.

Regards,
Rob

Re: Phantom Custom Code Alarm

johnteo — Mon, 16 Dec 2019 02:30:39 GMT

Thank you for your response ghays, I appreciate it.

Re: Phantom Custom Code Alarm

phantom_mhike — Mon, 16 Dec 2019 19:10:47 GMT

You could follow the advice I posted in your previous question and use slack or some other application to generate the sound alerts you are looking for.