Splunk SOAR (f.k.a. Phantom)

Unable to configure additional Phantom App repo

aocvy
Engager

We want to deliver app updates to Phantom automated via git, we do not want to upload a new app each time one is updated

Labels (3)
Tags (1)
0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

If these are custom apps that you have written, i have tackled automated deployment is kind of a sketchy way but it will work.

Log onto the phantom server via ssh and clone your app repository to the file system where ever you want it stored

Write a script that does the following:
• Pull the latest from the repo
• Pull the current app versions from the phantom API
• Check the current app version for each app in the repo
• If the repo version is different, run phantoms compile script with -i to install it to the server

Cron that script to your desired frequency or create a playbook that you can run adhoc that will run the script. I prefer cron because then you dont have to tangle with the permissions for the phantom-worker to run the script and execute all the required commands.

Its a little clunky but it gets you out of the business of creating and manually uploading custom app tgz files.

0 Karma

aocvy
Engager

Have you had any success with the approach of changing the git repo link from Phantom to one of your own?

I'm also looking at a way to change the git sync to a git hook, so it'll trigger on git pushes to master

0 Karma

phantom_mhike
SplunkTrust
SplunkTrust

No. I have never been in a situation where I wanted to drop the default app library.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...