Splunk SOAR (f.k.a. Phantom)

How to schedule a Phantom playbook to run at specific intervals?

AlexBryant
Path Finder

I have completed Phantom playbook that I need to run every 5 minutes. I know that the Timer app can be used to schedule playbook execution by generating events on a preset schedule, but how would a set up two separate schedules for two separate playbooks - say, one that runs every 5 minutes and one that runs hourly? Do I set up two Timer assets and somehow add identifying characteristics to differentiate the events that each asset will generate?

Labels (1)
Tags (1)
0 Karma
1 Solution

phantom_mhike
Path Finder

In the past I have created timers for these that generate containers and each of the timer assets apply a label to the containers that indicate their schedule ie. "scheduled-hourly" for a timer that generates every hour or "scheduled-daily", "scheduled-5min" etc. The different labels make it easy to apply playbooks to them as well as identify where the containers came from when looking at the analyst queue.

View solution in original post

phantom_mhike
Path Finder

In the past I have created timers for these that generate containers and each of the timer assets apply a label to the containers that indicate their schedule ie. "scheduled-hourly" for a timer that generates every hour or "scheduled-daily", "scheduled-5min" etc. The different labels make it easy to apply playbooks to them as well as identify where the containers came from when looking at the analyst queue.

AlexBryant
Path Finder

That worked! It took a few minutes to figure out how to implement it, so I'll post the details for others. Go into Administration --> Event Settings --> Label Settings. Add a new label with a meaningful name like "timer_5_minutes". In the Timer app, add a new asset, and in the ingest settings, set it to run on the appropriate schedule (in this case, every 5 minutes), and set the 'Label To Apply' to be the label added above in administration. Now, there's an asset in Timer that will run every 5 minutes and create an event called timer_5_minutes. In your playbook settings, set the "Operates On" value to also be "timer_5_minutes"...the playbook will now run every time the Timer app creates one of these events, and will execute according to your schedule.

satishclarios
New Member

@AlexBryant Thank you for detail explanation

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...