Splunk Enterprise Security

Phantom: Playbook that Prompts for User Input

jamolson
Path Finder

Wondering if Phantom has the ability to prompt for user input in a playbook.
Like a simple text box popup to allow for more dynamic notes.

From what we have seen it seems like you can really only do this with an App but that seems a bit much for some situations.
If anyone has done this, could you share how you did it?

0 Karma
1 Solution

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

View solution in original post

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

sloshburch
Splunk Employee
Splunk Employee

@jamolson - Assuming you don't mind, I cleaned up the markup so your solution renders like code. Also, thanks so much for posting and accepting your own answer! Others will now benefit from your efforts!

0 Karma

jamolson
Path Finder

Absolutely, I have not responded to many questions so I was not sure how to tag the lines to do that.
Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...