Splunk SOAR (f.k.a. Phantom)

Validating data of an action inside a decision?

CS_
Path Finder

I'm interested in suggestions on how to tackle this. I know how I would implement it in Python, but not really sure best practice for SOAR.

Let's say I have an Action called "Lookup Host"

If it runs successfully, it returns a dict with some data
[{"hostname": "test1", "device_id": "abc123"}]

but we might actually not have data on this host, so it will return empty:
[]

I need to ensure that we have data, otherwise later playbook actions won't complete.

Would we use a decision here - like "If result != []: continue, else: exit playbook"


Here's is loosely what I want to do, but in Python Code:

 

 

result = LookupHost(hostname="test1")

if result:
    # Have a result, so can continue
    run_second_action()

else:
    # no data found, exit
    exit(0)

 

 

Labels (1)
0 Karma
1 Solution

phantom_mhike
Path Finder

If decisions don't quite have the level of flexibility you need, you can create a validator utility that does what you propose. Run your action. pass the output to the validator, use a decision to check to see that the validator output "success", and then you can proceed to use the output from the action as needed. 

Its a little inconvenient to have plug a utility into the process but you will find several generic check scenarios that are challenging to implement with the logical capabilities in today's decisions. There are several ideas posted for how decision customizability could be improved but there are no guarantees on implementation or timeline for those yet.

View solution in original post

CS_
Path Finder

Hey @phantom_mhike 

Yeah that's more or less what i've been doing. Run action, pass to code block or custom function, if the data i need is there, return a success, have decision handle what to do if returned answer is success or not.

If that's the "accepted" way to do it, i'll soldier on with it. Thanks for the input!

0 Karma

phantom_mhike
Path Finder

If decisions don't quite have the level of flexibility you need, you can create a validator utility that does what you propose. Run your action. pass the output to the validator, use a decision to check to see that the validator output "success", and then you can proceed to use the output from the action as needed. 

Its a little inconvenient to have plug a utility into the process but you will find several generic check scenarios that are challenging to implement with the logical capabilities in today's decisions. There are several ideas posted for how decision customizability could be improved but there are no guarantees on implementation or timeline for those yet.

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...