Splunk Enterprise Security

Phantom: Playbook that Prompts for User Input

jamolson
Path Finder

Wondering if Phantom has the ability to prompt for user input in a playbook.
Like a simple text box popup to allow for more dynamic notes.

From what we have seen it seems like you can really only do this with an App but that seems a bit much for some situations.
If anyone has done this, could you share how you did it?

0 Karma
1 Solution

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

View solution in original post

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

sloshburch
Splunk Employee
Splunk Employee

@jamolson - Assuming you don't mind, I cleaned up the markup so your solution renders like code. Also, thanks so much for posting and accepting your own answer! Others will now benefit from your efforts!

0 Karma

jamolson
Path Finder

Absolutely, I have not responded to many questions so I was not sure how to tag the lines to do that.
Thank you very much.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...