Splunk SOAR (f.k.a. Phantom)

Playbook scheduling without containers

drew19
Path Finder

Is there a way to schedule a playbook run without having any container? Is it possible?

Labels (1)
Tags (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@drew19 A playbook always needs a container, but if you need playbooks to run without an "Alert" creating the container, the Phantom Timer app (here) will create empty containers on a schedule with a selected label defined. Any active playbooks against that label will then pick this up when created and process as per usual.

View solution in original post

phanTom
SplunkTrust
SplunkTrust

@drew19 A playbook always needs a container, but if you need playbooks to run without an "Alert" creating the container, the Phantom Timer app (here) will create empty containers on a schedule with a selected label defined. Any active playbooks against that label will then pick this up when created and process as per usual.

drew19
Path Finder

Thank you! ❤️ 

Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...