Splunk SOAR (f.k.a. Phantom)

Unable to configure additional Phantom App repo

aocvy
New Member

We want to deliver app updates to Phantom automated via git, we do not want to upload a new app each time one is updated

Labels (3)
Tags (1)
0 Karma

phantom_mhike
Path Finder

If these are custom apps that you have written, i have tackled automated deployment is kind of a sketchy way but it will work.

Log onto the phantom server via ssh and clone your app repository to the file system where ever you want it stored

Write a script that does the following:
• Pull the latest from the repo
• Pull the current app versions from the phantom API
• Check the current app version for each app in the repo
• If the repo version is different, run phantoms compile script with -i to install it to the server

Cron that script to your desired frequency or create a playbook that you can run adhoc that will run the script. I prefer cron because then you dont have to tangle with the permissions for the phantom-worker to run the script and execute all the required commands.

Its a little clunky but it gets you out of the business of creating and manually uploading custom app tgz files.

0 Karma

aocvy
New Member

Have you had any success with the approach of changing the git repo link from Phantom to one of your own?

I'm also looking at a way to change the git sync to a git hook, so it'll trigger on git pushes to master

0 Karma

phantom_mhike
Path Finder

No. I have never been in a situation where I wanted to drop the default app library.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.