Splunk SOAR (f.k.a. Phantom)

Using current container info in a custom function



Within a Custom Function, is it possible to grab information from the current container? For example, I've added this line to a function:

from_address = str(phantom.collect2(container=container, datapath=["artifact:*.cef.fromEmail"], limit=1)[0][0])

Ideally the value of the variable would just be a string of an email address. But I get an error that the variable "container" hasn't been defined.

However, when I test this line in the "custom code" section of a function block within a playbook, it works fine. 

Any thoughts on how I can achieve this? Thanks!

Labels (1)

Splunk Employee
Splunk Employee


You'll need to pass in container as a parameter to your function. Here is an example of what I believe you are trying to do:



Notice I have a parameter to the custom function called 'container'. I pass that in like this:



With the container available in the CF, you can use collect2 as expected. Interestingly, notice line 17 on the first screenshot. We have to do "container=container[0]" because the Container parameter of collect2 expects a dict but the data comes in as a list, so we have to extract the dict from the list's first element.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...