Splunk SOAR (f.k.a. Phantom)

Has anyone ever reassigned SOAR objects between users?

Path Finder

Hi folks,

I'm evaluating a situation related to enabling SAML auth on SOAR but earlier I was using local accounts. Because of that, objects like assets, playbooks, etc are currently tied to the local user ids, and SAML users have different user ids. I'm looking for ideas on how to update that ownership from local to SAML new user id in order to have the users still owning those objects after changing their login type.

Or, another option but that will be unlikely to be something doable, but if I could have the SAML login to use the same user id as the local (like one replace the other) would also be interesting to explore.

Tags (3)
0 Karma


@victor_menezes the way I would do this is to use REST. 

1. Go to /rest/ph_user and filter for the user ids of the old and new user
2. Find all "items" owned by the old user in the relevant REST endpoint
3. Write a custom function / code block to loop through the found items and update the user id value via POST

REST Docs: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlatformAPI/Using 

Use the phantom.requests() for local REST Calls: https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlaybookAPI/SessionAPI 


-- Hope this helped? If so please mark as a solution. Happy SOARing! --

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...