Splunk SOAR (f.k.a. Phantom)

Can I convert Splunk SOAR playbook type input to automation?

peterng_
Engager

Can I convert a playbook-type input to automation in Splunk SOAR (5.3.4)
Thanks for helping.

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@peterng_ unfortunately not as they are setup differently so even a "save_as" won't allow you to change the playbook type. 

In this case you will need to re-draw the playbook in the relevant playbook type but only if the playbook requires input variables, otherwise the automation type is still relevant. 


-- Happy SOARing, if this helped please mark as a solution --

phanTom

View solution in original post

phanTom
SplunkTrust
SplunkTrust

@peterng_ unfortunately not as they are setup differently so even a "save_as" won't allow you to change the playbook type. 

In this case you will need to re-draw the playbook in the relevant playbook type but only if the playbook requires input variables, otherwise the automation type is still relevant. 


-- Happy SOARing, if this helped please mark as a solution --

phanTom

Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...