topic Re: SOAR: Instance environment variables in Splunk SOAR

SOAR: Is it possible to retrieve the (splunk soar) instance details inside a playbook?

goncalocoelho — Wed, 29 Jun 2022 23:04:40 GMT

Hi All,

is it possible to retrieve the (splunk soar) instance details inside a playbook?

For instance when sending an email, I want to be able to tell if the playbook ran in dev or prod environment.

Is there a list of all the global environment variables?

Thanks in advance

Re: SOAR: Instance environment variables

phanTom — Wed, 22 Jun 2022 07:57:17 GMT

@goncalocoelho the best way, IMO, will be to use REST and hit the `/rest/system_settings` endpoint and get something from the company_info_settings to determine if dev/prod.

E.g. If you set the system/instance name to reflect the environment you could parse that, or just use the fqdn setting to work out where it came from.

This will need to be coded either in a code block or custom function.

Re: SOAR: Instance environment variables

goncalocoelho — Wed, 29 Jun 2022 17:23:22 GMT

Thanks for your reply @phanTom, that seems a very good approach!

I'll try that and share my findings here for everyone