topic Action Run Splunk Query Issues in Splunk SOAR

Action Run Splunk Query Issues

wilcompl1334 — Mon, 15 Feb 2021 16:01:16 GMT

I'm running into an issue where I have multiple artifacts that are being submitted as a Splunk query. Below is my current workflow:

Extract domains from URL
Format Splunk query as such: '|inputlookup someCSV.csv | search domain={0}'
Run Splunk query

The issue lies in the Splunk query that is run appears to be appending the artifacts in a comma delimited list rather than individual queries:

query = | inputlookup someCSV.csv | search domain=domain1.com, domain2.com, domain3.com

When i'm expecting the following searches to be run:

query = | inputlookup someCSV.csv | search domain=domain1.com
query = | inputlookup someCSV.csv | search domain=domain2.com
query = | inputlookup someCSV.csv | search domain=domain3.com

Is there a way to construct this so each domain extracted is run in a separate Splunk query?

Re: Action Run Splunk Query Issues

phanTom — Mon, 15 Feb 2021 16:08:19 GMT

@wilcompl1334

I can see you are using a format block due to the {0} item so this is a nice simple one 😄

If you wrap your format content like this and use the formatted_data.* output in the run_query block:

%%
|inputlookup someCSV.csv | search domain={0}
%%

You should see in the run_query that Phantom builds the for loop based on the formatted_data.* being recognised as a list object. Without the formatted_data.* it will dump all 3 as a single string.

If this helps please mark as so, or ask for more assistance.

phanTom

Re: Action Run Splunk Query Issues

wilcompl1334 — Mon, 15 Feb 2021 22:55:02 GMT

@phanTomThanks for the help with this, on going question as I'm now seeing the query that is passed actually formatted as such:

query: "| inputlookup someCSV.csv | search domain=domain1.com | inputlookup someCSV.csv | search domain=domain2.com | inputlookup someCSV.csv | search domain=domain3.com"

Rather than individual queries, it appears it's formatted these all as a single, chained query, and passed it off to Splunk.

I'm not at the terminal any longer, but do I need to loop the run_query block as well with the output of formatted_data.* by doing the same for the input of run_query:

{0}

Re: Action Run Splunk Query Issues

phanTom — Tue, 16 Feb 2021 09:07:46 GMT

@wilcompl1334 you will need to pass in the formatted_data.* output from the format block into the query field of the run_query action (as per the diagram).

Try selecting each option and watch the Code in the Playbook Editor tab for the change:
* If using formatted_data.* output the code has a for loop to add a single parameter for each item found in the formatted data output

* If using just formatted_data it passes in the list (built in the format block using %'s) as a single string parameter.

So unless you are doing something custom I am not aware of, simply by using the %%{0}%% method in the format block and selecting the formatted_data.* datapath in the query field, Phantom will see each item in the list as a separate parameter and pass them individually into the run_query action.

Using the format block with the %%{0}%% in will create:
| inputlookup someCSV.csv | search domain=domain1.com
| inputlookup someCSV.csv | search domain=domain2.com
| inputlookup someCSV.csv | search domain=domain3.com

If you pass it in as just formatted_data then the code will look like this:

# build parameters list for 'run_query_1' call
parameters.append({
'command': "search",
'query': formatted_data_1,
'display': "",
'parse_only': "",
})

However if you use the formatted_data.* it will/should change to this:
# build parameters list for 'run_query_1' call
for formatted_part_1 in formatted_data_1:
parameters.append({
'command': "search",
'query': formatted_part_1,
'display': "",
'parse_only': "",
})

I am 100% sure, again unless you are doing something custom I am not aware of, this will work for you.

Re: Action Run Splunk Query Issues

jesuamal — Wed, 16 Mar 2022 22:48:46 GMT

I am currently working on a similar task that passing the formatted block value to Splunk query to get an out put required for the next action. My search query

|inputlookup agentid.csv | search hostname=hostname1| fields agentid

My format block configured as below,

Template

{0}

Template Parameters

0 = get_variables_2:action_result.data.*.Computer ID

Can you please advise me how to pass this computer ID to my Splunk query as mentioned above?