Splunk SOAR (f.k.a. Phantom)

Using current container info in a custom function

s2233
Explorer

Hi,

Within a Custom Function, is it possible to grab information from the current container? For example, I've added this line to a function:

from_address = str(phantom.collect2(container=container, datapath=["artifact:*.cef.fromEmail"], limit=1)[0][0])

Ideally the value of the variable would just be a string of an email address. But I get an error that the variable "container" hasn't been defined.

However, when I test this line in the "custom code" section of a function block within a playbook, it works fine. 

Any thoughts on how I can achieve this? Thanks!

Labels (1)

sam_splunk
Splunk Employee
Splunk Employee

Howdy!

You'll need to pass in container as a parameter to your function. Here is an example of what I believe you are trying to do:

sam_splunk_0-1607361221206.png

 

Notice I have a parameter to the custom function called 'container'. I pass that in like this:

sam_splunk_1-1607361268959.png

 

With the container available in the CF, you can use collect2 as expected. Interestingly, notice line 17 on the first screenshot. We have to do "container=container[0]" because the Container parameter of collect2 expects a dict but the data comes in as a list, so we have to extract the dict from the list's first element.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...