Splunk SOAR (f.k.a. Phantom)

How to decrypt the password from the asset, while developing a custom app?

victor_menezes
Path Finder

Hi everyone,

I'm looking for a solution here while playing around with the app builder on SOAR, and I could get the asset interface work fine and from the code I can get the values from there, but the password type returns as an encrypted string instead (as the field is a password field).
How can I decrypt it so the code can use that value in runtime accordingly?

Labels (3)
1 Solution

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

View solution in original post

phanTom
SplunkTrust
SplunkTrust

This is a bug and is resolved in the latest version past 5.3.x 

One way is to publish and test, or another is to hardcode the relevant details in whilst using the IDE, then remove before publishing. This will allow for the use of the IDE whilst testing but you need to remember to remove before publishing. 

0 Karma

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

victor_menezes
Path Finder

Thanks @hariomenkel. Works like a charm!

0 Karma

scorsatto
Explorer

Thank you for this, I was having the same issue. Indeed we can only test the asset user/password after we install the app. this is an improvement opportunity I would say for SOAR, as we can't test it before deploy the app

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...