Splunk SOAR (f.k.a. Phantom)

How to get the results of a playbook to show up as a note in a different phase?

Ragamonster
New Member

Hello, I've been tasked with having the results of a playbook show up as a note in a different phase.

Any instruction or ideas welcome.

Thanks so much.

Labels (1)
Tags (1)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@Ragamonster you will need to use REST to find the task you want to add the note to and then POST the note to that task.

https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlatformAPI/RESTNotes 

Specifically look at the below:

phanTom_0-1697792118004.png


You can do this using the HTTP app but I prefer using the sessions API as it's pre-authenticated and gives you a lot more control: https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlaybookAPI/SessionAPI 

-- Hope this helps. If so please mark as a solution for future readers. Happy SOARing! --

0 Karma

SOARt_of_Lost
Path Finder

What sorts of results are you trying to post as a note? You can plug just about anything you want into a utility block calling the add note function. You can insert a format block just before the note block and use its formatted_data (not formatted_data.*) output to make it look nicer or combine info from different sources.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...