Splunk Enterprise Security

Phantom: Playbook that Prompts for User Input

jamolson
Path Finder

Wondering if Phantom has the ability to prompt for user input in a playbook.
Like a simple text box popup to allow for more dynamic notes.

From what we have seen it seems like you can really only do this with an App but that seems a bit much for some situations.
If anyone has done this, could you share how you did it?

0 Karma
1 Solution

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

View solution in original post

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

sloshburch
Ultra Champion

@jamolson - Assuming you don't mind, I cleaned up the markup so your solution renders like code. Also, thanks so much for posting and accepting your own answer! Others will now benefit from your efforts!

0 Karma

jamolson
Path Finder

Absolutely, I have not responded to many questions so I was not sure how to tag the lines to do that.
Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...