topic Re: Pass format block data to subplaybook in Splunk SOAR

Pass format block data to subplaybook

shaquibk — Thu, 23 Sep 2021 07:53:33 GMT

Hi Team,

I want to know if it is possible pass data present in a format block of one playbook to another playbook being called. So its like

PB1--->Format block -------> PB2 called ------>PB2 performs functions on the previous format block data.

I know as a workaround this can be done by adding an artifact and using it in subplaybook. But would prefer if it is possible without it.

Kindly let me know if any further info is required.

Thanks in advance!

Regards,

Shaquib

phanTom — Thu, 23 Sep 2021 08:17:04 GMT

@shaquibk you could look to use phantom.save_object() and phantom.get_object() to save and retrieve the formatted string in another playbook. Not sure if the process will mess with formatting but they will certainly persist the formatted data string for re-use.

save_object() : https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/DataManagementAPI#save_object

get_object(): https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/DataManagementAPI#get_object

Happy Phantoming!