Dashboards & Visualizations
Highlighted

Phantom visual editor is disabled

Explorer

When editing a playbook in the Phantom web interface something is intermittently causing the visual editor to become locked with the message "Visual Editor Disabled".
I can still edit the playbook with the Python Playbook Editor at the bottom.
What would cause the visual editor to become locked?

0 Karma
Highlighted

Re: Phantom visual editor is disabled

Splunk Employee
Splunk Employee

@Chancerose91,

When you edit with the Visual Playbook Editor (VPE), great care must be taken (oh and the warning message that follows) to make sure you are not selected on the canvas verses the block that you are trying to edit otherwise this happens. If it does, you can immediately revert the playbook back to the original state, however, if you (like you stated) have continued to make changes, reverting would lose your work that you performed. In the screenshot below, you can see the "Full Code" is selected next to function.
alt text

When you make a change in the Python Playbook Editor with Full Code, you should see this warning above ...

To revert this block, you just have to click on the revert icon in the lower right hand side as seen in the image below.
alt text

This will revert you playbook back to it's former glory. Make sure that you select the blocks that you want to modify verses the canvas or full code view to make any custom code changes.

View solution in original post

Highlighted

Re: Phantom visual editor is disabled

New Member

The usability of editing code in a playbook has been overlooked, and the only use case Phantom has is for non-developers using pre-designed blocks

For developers, your only path is to create a custom Phantom app

0 Karma
Highlighted

Re: Phantom visual editor is disabled

Splunk Employee
Splunk Employee

Actually, I think that's not 100% true. If you understand how playbooks are called. Developers can just build the shell playbooks, send it to a git repo, know that on_start() (use it like main) and on_finish() are always called... place whatever code you want in the middle of these blocks.

You can choose to use the API or not, you won't have the benefit of multi-threading or other awesome capabilities without incorporating the phantom api usage in your code.

We just make it much easier for "non-coders" to quickly get an automation into motion. The part that you won't like is that your code won't run with an IDE by default. Debugging will still be done via the phantom VPE.

We do have a few folks that have made workarounds for some of the issues you may think you are encountering. I recommend talking to our Professional Services teams on different tricks to get you going the way you would want ... or at least closer.

0 Karma
Highlighted

Re: Phantom visual editor is disabled

New Member

This was in response to the Phantom UI becoming disabled when you want to change code via git.

As long as the beginning and end of a Phantom Block are the same, the UI should remain functional, but it does not.

My guess is that, rather than having to figure out how much of a Phantom Block has changed to ensure the UI remains functional, it's easier for Phantom just to not support it.

0 Karma
Highlighted

Re: Phantom visual editor is disabled

Splunk Employee
Splunk Employee

Always keep any custom code you may need within a single block/function inside of a playbook. Custom Function blocks work nicely for this, or you can modify the generated code within an Action, Filter, Decision, API Block. Keeping your custom code within a single block will allow you to continue using the UI builder as expected.

0 Karma
Highlighted

Re: Phantom visual editor is disabled

New Member

Not if you're editing within this code block outside of the Phantom UI

For example, if you edit within this Custom Code block on git, and resync, Phantom UI is disabled

Even if you add a commented line (which has no impact on code execution), Phantom UI is disabled

Phantom has not designed the UI to work together with git on a usability level

0 Karma
Highlighted

Re: Phantom visual editor is disabled

Splunk Employee
Splunk Employee

The original question was around editing playbook code within the Phantom UI.

What you've described is by design.

Highlighted

Re: Phantom visual editor is disabled

New Member

what were the design limitations to have this work better?

0 Karma
Highlighted

Re: Phantom visual editor is disabled

Splunk Employee
Splunk Employee

Out of band content changes for custom code are validate to ensure code injections don't occur. As @cblumer_splunk stated, from my understanding. If you don't want to use the UI, then you can use the global block and write your own functions to your hearts content.

0 Karma