Splunk Enterprise Security

Phantom: Playbook that Prompts for User Input

Path Finder

Wondering if Phantom has the ability to prompt for user input in a playbook.
Like a simple text box popup to allow for more dynamic notes.

From what we have seen it seems like you can really only do this with an App but that seems a bit much for some situations.
If anyone has done this, could you share how you did it?

0 Karma
1 Solution

Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effectiveuserid and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

View solution in original post

0 Karma

Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effectiveuserid and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

View solution in original post

0 Karma

Ultra Champion

@jamolson - Assuming you don't mind, I cleaned up the markup so your solution renders like code. Also, thanks so much for posting and accepting your own answer! Others will now benefit from your efforts!

0 Karma

Path Finder

Absolutely, I have not responded to many questions so I was not sure how to tag the lines to do that.
Thank you very much.

0 Karma