Splunk SOAR (f.k.a. Phantom)

Phantom Playbook calling playbook block synchronous

dphegarty
New Member

I have a top level playbook that calls two playbooks, on that does some analysis and the second one that promotes the event to a case based on artifacts created by the first playbook and it does not appear to honor the Synchronous flag

Playbook 1
Calls Playbook A that does some analysis
Playbook A calls Playbook B based on some indicators to query Splunk for additional data and adds new artifacts.
Calls Playbook C that will promote the event to a case and send out email notifications based on data in the artifacts'

All the Playbook blocks have Synchronous turned on and yet the Playbook C runs immediately after Playbook A launches. Playbook C does not wait for Playbook A to finish .

I've created some simple Playbooks to test Synchronous and it does not appear to exhilarate the behavior stated in the documentation:

To set the called playbook to run in synchronous mode, click the Synchronous toggle. This makes the calling playbook wait for the called playbook to complete before continuing

What am I missing ?

Labels (2)
Tags (1)
0 Karma

dphegarty
New Member

Found the answer to this issues. There can not be multiple paths to the "End" block within the playbook that can evaluate to true. Multiple paths run in parallel and as long as one path reaches the end block the playbook is considered completed even if another path is still running.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...