Dashboards & Visualizations

What causes Phantom visual editor to be disabled?

chancerose91
Explorer

When editing a playbook in the Phantom web interface something is intermittently causing the visual editor to become locked with the message "Visual Editor Disabled".
I can still edit the playbook with the Python Playbook Editor at the bottom.
What would cause the visual editor to become locked?

Labels (1)
0 Karma
1 Solution

rgresham_splunk
Splunk Employee
Splunk Employee

@Chancerose91,

When you edit with the Visual Playbook Editor (VPE), great care must be taken (oh and the warning message that follows) to make sure you are not selected on the canvas verses the block that you are trying to edit otherwise this happens. If it does, you can immediately revert the playbook back to the original state, however, if you (like you stated) have continued to make changes, reverting would lose your work that you performed. In the screenshot below, you can see the "Full Code" is selected next to function.
alt text

When you make a change in the Python Playbook Editor with Full Code, you should see this warning above ...

To revert this block, you just have to click on the revert icon in the lower right hand side as seen in the image below.
alt text

This will revert you playbook back to it's former glory. Make sure that you select the blocks that you want to modify verses the canvas or full code view to make any custom code changes.

View solution in original post

cblumer_splunk
Splunk Employee
Splunk Employee

Always keep any custom code you may need within a single block/function inside of a playbook. Custom Function blocks work nicely for this, or you can modify the generated code within an Action, Filter, Decision, API Block. Keeping your custom code within a single block will allow you to continue using the UI builder as expected.

0 Karma

aocvy
Engager

Not if you're editing within this code block outside of the Phantom UI

For example, if you edit within this Custom Code block on git, and resync, Phantom UI is disabled

Even if you add a commented line (which has no impact on code execution), Phantom UI is disabled

Phantom has not designed the UI to work together with git on a usability level

0 Karma

cblumer_splunk
Splunk Employee
Splunk Employee

The original question was around editing playbook code within the Phantom UI.

What you've described is by design.

aocvy
Engager

what were the design limitations to have this work better?

0 Karma

rgresham_splunk
Splunk Employee
Splunk Employee

Out of band content changes for custom code are validate to ensure code injections don't occur. As @cblumer_splunk stated, from my understanding. If you don't want to use the UI, then you can use the global block and write your own functions to your hearts content.

0 Karma

aocvy
Engager

But you can have the playbook run any code

I don't think it's really validating the code, otherwise adding one commented out line should have remained valid, and not disable the UI? Since a commented line shouldn't be a code injection

The thing is, we want to use the UI, and we want to use custom code without the UI being disabled, as long as we've kept the proper structure of the custom code block, the code inside should not matter

0 Karma

aocvy
Engager

The usability of editing code in a playbook has been overlooked, and the only use case Phantom has is for non-developers using pre-designed blocks

For developers, your only path is to create a custom Phantom app

0 Karma

rgresham_splunk
Splunk Employee
Splunk Employee

Actually, I think that's not 100% true. If you understand how playbooks are called. Developers can just build the shell playbooks, send it to a git repo, know that on_start() (use it like main) and on_finish() are always called... place whatever code you want in the middle of these blocks.

You can choose to use the API or not, you won't have the benefit of multi-threading or other awesome capabilities without incorporating the phantom api usage in your code.

We just make it much easier for "non-coders" to quickly get an automation into motion. The part that you won't like is that your code won't run with an IDE by default. Debugging will still be done via the phantom VPE.

We do have a few folks that have made workarounds for some of the issues you may think you are encountering. I recommend talking to our Professional Services teams on different tricks to get you going the way you would want ... or at least closer.

0 Karma

aocvy
Engager

This was in response to the Phantom UI becoming disabled when you want to change code via git.

As long as the beginning and end of a Phantom Block are the same, the UI should remain functional, but it does not.

My guess is that, rather than having to figure out how much of a Phantom Block has changed to ensure the UI remains functional, it's easier for Phantom just to not support it.

0 Karma

rgresham_splunk
Splunk Employee
Splunk Employee

@Chancerose91,

When you edit with the Visual Playbook Editor (VPE), great care must be taken (oh and the warning message that follows) to make sure you are not selected on the canvas verses the block that you are trying to edit otherwise this happens. If it does, you can immediately revert the playbook back to the original state, however, if you (like you stated) have continued to make changes, reverting would lose your work that you performed. In the screenshot below, you can see the "Full Code" is selected next to function.
alt text

When you make a change in the Python Playbook Editor with Full Code, you should see this warning above ...

To revert this block, you just have to click on the revert icon in the lower right hand side as seen in the image below.
alt text

This will revert you playbook back to it's former glory. Make sure that you select the blocks that you want to modify verses the canvas or full code view to make any custom code changes.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...