Splunk SOAR (f.k.a. Phantom)

Splunk Phantom SOAR Vault tmp Directory Clean Up




In short, I have to transmute a file, and I leverage the /vault/tmp/ directory.


I'm able to do what I want, but I'm wondering if I have to 'clean up' this /vault/tmp/ directory.


ex - I have a file I want to XOR bit by bit. I read unxord.exe bit by bit, write to /vault/tmp/xord.exe, then I do a phantom.vault_add(file_location="/vault/tmp/xord.exe"). This works fine.


Do I have to do any removal of the "/vault/tmp/xord.exe"?


I've tried to do something like:

import os



However, I get a path not found error.


 So, how often does Phantom SOAR clean up the /vault/tmp/ directory, and can/should I remove the temp file myself?



0 Karma


@splunk4days i believe that by using the phantom.vault_add() API the file is "moved" from the tmp dir into the relevant file location on the platform where the vault storage is, rather than copied.

I have not tested this but have also never had to clear the /tmp dir when using it for vault_add() API calls. 

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...