Splunk SOAR (f.k.a. Phantom)

Unable to configure additional Phantom App repo

aocvy
Engager

We want to deliver app updates to Phantom automated via git, we do not want to upload a new app each time one is updated

Labels (3)
Tags (1)
0 Karma

phantom_mhike
Path Finder

If these are custom apps that you have written, i have tackled automated deployment is kind of a sketchy way but it will work.

Log onto the phantom server via ssh and clone your app repository to the file system where ever you want it stored

Write a script that does the following:
• Pull the latest from the repo
• Pull the current app versions from the phantom API
• Check the current app version for each app in the repo
• If the repo version is different, run phantoms compile script with -i to install it to the server

Cron that script to your desired frequency or create a playbook that you can run adhoc that will run the script. I prefer cron because then you dont have to tangle with the permissions for the phantom-worker to run the script and execute all the required commands.

Its a little clunky but it gets you out of the business of creating and manually uploading custom app tgz files.

0 Karma

aocvy
Engager

Have you had any success with the approach of changing the git repo link from Phantom to one of your own?

I'm also looking at a way to change the git sync to a git hook, so it'll trigger on git pushes to master

0 Karma

phantom_mhike
Path Finder

No. I have never been in a situation where I wanted to drop the default app library.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!