Splunk SOAR (f.k.a. Phantom)

Email user and get response back

rodneyjerome
Explorer

Hi,

 

I am looking send an email to user with simple yes/no response which I can then use to handle the case. I know Palo Alto’s soar has some integrations to handle this. Do we have similar func in Splunk or any idea on how to implement them.

 

Thanks in advance 

Labels (1)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@rodneyjerome it's not out of the box but the way I have done this is with 2 playbooks:

1.  1st/any playbook that sends an email that expects a response first builds an encrypted string that contains useful information for the response (  i use container_id + label value ), then builds a HTML body with the token inserted with an obvious prefix ( easy to pick out in regex )  and then sends the email and completes. 

In the middle, you have an app monitoring and ingesting from the mailbox/folder where the user will be replying to. 

2. 2nd playbook runs on these ingested emails, retrieves the key value, decrypts it and then uses the information to understand which container to update/work on. 

This can be expanded nicely by adding more relevant information into the inserted key. 

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!