Splunk SOAR (f.k.a. Phantom)

Phantom Playbook calling playbook block synchronous

dphegarty
New Member

I have a top level playbook that calls two playbooks, on that does some analysis and the second one that promotes the event to a case based on artifacts created by the first playbook and it does not appear to honor the Synchronous flag

Playbook 1
Calls Playbook A that does some analysis
Playbook A calls Playbook B based on some indicators to query Splunk for additional data and adds new artifacts.
Calls Playbook C that will promote the event to a case and send out email notifications based on data in the artifacts'

All the Playbook blocks have Synchronous turned on and yet the Playbook C runs immediately after Playbook A launches. Playbook C does not wait for Playbook A to finish .

I've created some simple Playbooks to test Synchronous and it does not appear to exhilarate the behavior stated in the documentation:

To set the called playbook to run in synchronous mode, click the Synchronous toggle. This makes the calling playbook wait for the called playbook to complete before continuing

What am I missing ?

Labels (2)
Tags (1)
0 Karma

dphegarty
New Member

Found the answer to this issues. There can not be multiple paths to the "End" block within the playbook that can evaluate to true. Multiple paths run in parallel and as long as one path reaches the end block the playbook is considered completed even if another path is still running.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...