Splunk SOAR (f.k.a. Phantom)

Has anyone ever reassigned SOAR objects between users?

Path Finder

Hi folks,

I'm evaluating a situation related to enabling SAML auth on SOAR but earlier I was using local accounts. Because of that, objects like assets, playbooks, etc are currently tied to the local user ids, and SAML users have different user ids. I'm looking for ideas on how to update that ownership from local to SAML new user id in order to have the users still owning those objects after changing their login type.

Or, another option but that will be unlikely to be something doable, but if I could have the SAML login to use the same user id as the local (like one replace the other) would also be interesting to explore.

Tags (3)
0 Karma


@victor_menezes the way I would do this is to use REST. 

1. Go to /rest/ph_user and filter for the user ids of the old and new user
2. Find all "items" owned by the old user in the relevant REST endpoint
3. Write a custom function / code block to loop through the found items and update the user id value via POST

REST Docs: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlatformAPI/Using 

Use the phantom.requests() for local REST Calls: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlaybookAPI/SessionAPI 


-- Hope this helped? If so please mark as a solution. Happy SOARing! --

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...