Splunk SOAR (f.k.a. Phantom)

Retrieving phantom playbooks via CLI

taeshin
New Member

I'm currently having trouble accessing Phantom via web gui, it's giving 500 error.

I just need to retrieve the custom playbooks that we've built. Is there a way that we can retrieve the phantom playbooks via CLI, since it's on-prem server?

Thanks in advance!

Labels (2)
0 Karma

KeiranY
Engager

Phantom stores it's playbook repos under $PHANTOM_HOME/scm/git/$REPO_NAME. PHANTOM_HOME is usually '/opt/phantom' and the default repo is called 'local'.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...