Splunk SOAR (f.k.a. Phantom)

Are there any locking or concurrency guarantees when playbooks are operating on a container?

buzz_gt
New Member

Question: Are there any locking or concurrency guarantees when playbooks are operating on a container?

Issue I am trying to solve: I have a playbook (call it sub-playbook) that is called by two different parent playbooks ( parent1 and parent2). So parent1 will set param1 to True using save_object, keyed to containerN ( phantom.save_object(container_id=container['id'], key='param1', value={'param1':True}). parent2 sets param1 to False (also keyed to containerN) and calls sub-playbook. sub-playbook gets the value of param1, and acts different depending on whether it's True/False.

sub-playbook is called synchronously by both parent1 and parent2

As far as I know there are no concurrency guarantees (e.g. playbook1 -> sub-playbook could get interrupted after setting param1, but before sub-playbook checks/reads param1). This would cause a race condition. Is that accurate or does phantom lock all access to a container to the playbook (and sub-playbooks) that are operating on it?

Assuming my assumption is correct, and there are no concurrency guarantees, are there any built in patterns that people use to work around this? I can envision using some external capability (redis, maybe a custom app that uses sqllite, etc) to add my own locking, but I don't want to reinvent the wheel if it's not necessary.

Thanks!

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...