Splunk SOAR (f.k.a. Phantom)

Email user and get response back




I am looking send an email to user with simple yes/no response which I can then use to handle the case. I know Palo Alto’s soar has some integrations to handle this. Do we have similar func in Splunk or any idea on how to implement them.


Thanks in advance 

Labels (1)
0 Karma


@rodneyjerome it's not out of the box but the way I have done this is with 2 playbooks:

1.  1st/any playbook that sends an email that expects a response first builds an encrypted string that contains useful information for the response (  i use container_id + label value ), then builds a HTML body with the token inserted with an obvious prefix ( easy to pick out in regex )  and then sends the email and completes. 

In the middle, you have an app monitoring and ingesting from the mailbox/folder where the user will be replying to. 

2. 2nd playbook runs on these ingested emails, retrieves the key value, decrypts it and then uses the information to understand which container to update/work on. 

This can be expanded nicely by adding more relevant information into the inserted key. 

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...