topic Re: How do I get a phantom user object from the API? in Splunk SOAR

How do I get a phantom user object from the API?

nhammSplunk — Sun, 07 Jun 2020 16:25:43 GMT

What's the api command to get the current logged-in user without specifying the user id. I want to type phantom.get_user() and have the attributes of the logged-in user returned.

Re: How do I get a phantom user object from the API?

phantom_mhike — Wed, 30 Sep 2020 05:11:16 GMT

Within the context of a playbook you can use this to get the user that executed the playbook. This is only effective if a user manually executed the playbook, otherwise it will just return the id of the automation user.

user_id = phantom.get_effective_user()

Hopefully that answers your question. Outside of the context of playbook execution, the premise of "the current logged in user" doesn't make any sense. Any number of users could be logged in at any given time.

Re: How do I get a phantom user object from the API?

nhammSplunk — Thu, 30 Apr 2020 18:23:38 GMT

Thanks! This is exactly what I needed.

Re: How do I get a phantom user object from the API?

techlord — Tue, 01 Jun 2021 19:33:19 GMT

Can you point me to documentation for the phantom.get_effective_user() function? From what was stated in the above solution, it seems safe to assume if an ID(number) is returned by phantom.get_effective_user(), then the user running the playbook is an automated user, but would like to get confirmation.

Thanks!

Re: How do I get a phantom user object from the API?

phanTom — Wed, 02 Jun 2021 08:15:05 GMT

@techlord the API to use to get a playbooks effective_user inside the playbook is phantom.get_playbook_info()

This then returns a JSON where the 'effective_user' key will be the ID of the user running the playbook. The out-of-the-box automation account is 2 and admin is 1 so any other number would generally relate to an actual user account running the playbook.

You can have multiple automation accounts but they would only appear with this API if they were used to run the playbook, which is a manual change to the default settings in the playbook settings.

Playbooks can be run under user or automation scope and this API will be able to tell you the ID of the initiator and you can use it for other actions downstream if required, such as dynamically prompting the person who ran the playbook.

Re: How do I get a phantom user object from the API?

DanielEhrlich — Thu, 19 May 2022 19:56:05 GMT

Is there a way to map the id number to the user name?

Re: How do I get a phantom user object from the API?

phanTom — Thu, 19 May 2022 22:50:29 GMT

@DanielEhrlich yes if you pass the ID into /rest/ph_user/<id> it will return a dictionary with all the user information.