topic Re: Using current container info in a custom function in Splunk SOAR

Using current container info in a custom function

s2233 — Fri, 04 Dec 2020 17:47:38 GMT

Hi,

Within a Custom Function, is it possible to grab information from the current container? For example, I've added this line to a function:

from_address = str(phantom.collect2(container=container, datapath=["artifact:*.cef.fromEmail"], limit=1)[0][0])

Ideally the value of the variable would just be a string of an email address. But I get an error that the variable "container" hasn't been defined.

However, when I test this line in the "custom code" section of a function block within a playbook, it works fine.

Any thoughts on how I can achieve this? Thanks!

Re: Using current container info in a custom function

sam_splunk — Mon, 07 Dec 2020 17:15:43 GMT

Howdy!

You'll need to pass in container as a parameter to your function. Here is an example of what I believe you are trying to do:

Notice I have a parameter to the custom function called 'container'. I pass that in like this:

With the container available in the CF, you can use collect2 as expected. Interestingly, notice line 17 on the first screenshot. We have to do "container=container[0]" because the Container parameter of collect2 expects a dict but the data comes in as a list, so we have to extract the dict from the list's first element.