I am developing a Splunk SOAR app that retrieve a json from our backend and ingest it into a container in splunk soar. However, I need to show some fields that are not included in the container schema and i want those custom fields to be deployed with my app. Therefore my question, Is it possible to add custom fields to a splunk phantom container schema programmatically so our customers do not need to create them manually in the Splunk SOAR user interface?
Have you thought about using the container API?
phantom.add_artifact(container=None, raw_data=None, cef_data=None, label=None, name=None, severity=None, identifier=None, artifact_type=None, field_mapping=None, trace=False, run_automation=False)