Splunk SOAR (f.k.a. Phantom)

Has anyone ever reassigned SOAR objects between users?

Path Finder

Hi folks,

I'm evaluating a situation related to enabling SAML auth on SOAR but earlier I was using local accounts. Because of that, objects like assets, playbooks, etc are currently tied to the local user ids, and SAML users have different user ids. I'm looking for ideas on how to update that ownership from local to SAML new user id in order to have the users still owning those objects after changing their login type.

Or, another option but that will be unlikely to be something doable, but if I could have the SAML login to use the same user id as the local (like one replace the other) would also be interesting to explore.

Tags (3)
0 Karma


@victor_menezes the way I would do this is to use REST. 

1. Go to /rest/ph_user and filter for the user ids of the old and new user
2. Find all "items" owned by the old user in the relevant REST endpoint
3. Write a custom function / code block to loop through the found items and update the user id value via POST

REST Docs: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlatformAPI/Using 

Use the phantom.requests() for local REST Calls: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlaybookAPI/SessionAPI 


-- Hope this helped? If so please mark as a solution. Happy SOARing! --

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...