Splunk SOAR (f.k.a. Phantom)

Phantom Playbook calling playbook block synchronous

dphegarty
New Member

I have a top level playbook that calls two playbooks, on that does some analysis and the second one that promotes the event to a case based on artifacts created by the first playbook and it does not appear to honor the Synchronous flag

Playbook 1
Calls Playbook A that does some analysis
Playbook A calls Playbook B based on some indicators to query Splunk for additional data and adds new artifacts.
Calls Playbook C that will promote the event to a case and send out email notifications based on data in the artifacts'

All the Playbook blocks have Synchronous turned on and yet the Playbook C runs immediately after Playbook A launches. Playbook C does not wait for Playbook A to finish .

I've created some simple Playbooks to test Synchronous and it does not appear to exhilarate the behavior stated in the documentation:

To set the called playbook to run in synchronous mode, click the Synchronous toggle. This makes the calling playbook wait for the called playbook to complete before continuing

What am I missing ?

Labels (2)
Tags (1)
0 Karma

dphegarty
New Member

Found the answer to this issues. There can not be multiple paths to the "End" block within the playbook that can evaluate to true. Multiple paths run in parallel and as long as one path reaches the end block the playbook is considered completed even if another path is still running.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...