Splunk SOAR (f.k.a. Phantom)

Using current container info in a custom function

s2233
Explorer

Hi,

Within a Custom Function, is it possible to grab information from the current container? For example, I've added this line to a function:

from_address = str(phantom.collect2(container=container, datapath=["artifact:*.cef.fromEmail"], limit=1)[0][0])

Ideally the value of the variable would just be a string of an email address. But I get an error that the variable "container" hasn't been defined.

However, when I test this line in the "custom code" section of a function block within a playbook, it works fine. 

Any thoughts on how I can achieve this? Thanks!

Labels (1)

sam_splunk
Splunk Employee
Splunk Employee

Howdy!

You'll need to pass in container as a parameter to your function. Here is an example of what I believe you are trying to do:

sam_splunk_0-1607361221206.png

 

Notice I have a parameter to the custom function called 'container'. I pass that in like this:

sam_splunk_1-1607361268959.png

 

With the container available in the CF, you can use collect2 as expected. Interestingly, notice line 17 on the first screenshot. We have to do "container=container[0]" because the Container parameter of collect2 expects a dict but the data comes in as a list, so we have to extract the dict from the list's first element.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...