Splunk SOAR (f.k.a. Phantom)

Container data vs Custom Application Results

scorsatto
Explorer

I'm creating a custom application in SOAR and one of the fields this custom application provides is a password information, for obvious reasons, I don't want to store the password in the container, rather I just would like to add it in a parameter that I can use during playbook execution only. is there any way I can do it?

Version: Splunk SOAR 5.2.1.78411

What I'm doing today in my custom app is:

if secret_value:
          self.save_progress("Secret value retrieved successfully")
          action_result.add_data({"succeeded": True, "secret_value": secret_value})
         return action_result.set_status(phantom.APP_SUCCESS, 'Successfully retrieved secret value')

but the secret value is saved in the container.

 

Labels (2)
0 Karma
1 Solution

scorsatto
Explorer

yup, I'll need to use a hashing.. I would be great to have this such functionality in the app development, like a new command to pass the results only without save the data to the container.

Thanks @phanTom for your help!

View solution in original post

0 Karma

scorsatto
Explorer

yup, I'll need to use a hashing.. I would be great to have this such functionality in the app development, like a new command to pass the results only without save the data to the container.

Thanks @phanTom for your help!

0 Karma

phanTom
SplunkTrust
SplunkTrust

@scorsatto if you are using either CyberArk/Hashicorp/Thycotic then the platform already supports that for application assets to be able to retrieve the password(s) from a vault for one time use only. 

If you are not using any of the above then I think the hashing is your best way. 

-- If this resolved your issue please mark as a Solution! Happy SOARing --

0 Karma

phanTom
SplunkTrust
SplunkTrust

@scorsatto if you add to action_results then it will be included in the JSON added to the container and there is no real way around it. You could hash it and then decode in the playbook when you need it?

I would like to understand what the app does a bit more as to why you would pass a secret out for playbook use when you can just create an app and use it in a playbook and keep the secret/password in the app config where it's already hidden. 

0 Karma

scorsatto
Explorer

Hello @phanTom, the app will be used to retrieve secrets from another tool like passwordVault, if there is no other alternative, I think I'll have to hash the password to avoid any exposures.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...