Splunk SOAR (f.k.a. Phantom)

Why are we experiencing this Error "authentication failure on Phantom 4.10"?

mrzn
New Member

We are using Prompt with extended time to 4 days. We have discovered that when the time of running playbook is over the Inactivity Timeout in Account Security Settings we have playbook execution error and a lot of authentication failure when we want to change status or add tag etc. Is theare an option than we can use Prompt with respond_in_mins larger than Inactivity Timeout and avoid authentication failure errors. Phantom version 4.10.

Labels (3)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@mrzn I would remove the 4 days wait and try to handle this in a different way as this is far from best-practise. Each playbook with a prompt waiting for response will be keeping a daemon resource active the whole time and is excessive, IMHO. It also isn't robust as if the server or daemon was ever restarted you would lose all existing prompts!!

Depending on the use case I think you would be better to send an email with an encoded string that gets added to the HTML body, this usually contains the container_id the email was sent from and any other useful information to inform the automation upon reply and decryption. You then ingest the emails from the inbox where replies go to, have a playbook that grabs the encrypted key, decrypts and then takes the relevant action on the event. This way you are not keeping playbook(s) in a waiting state for up to 4 days. 

There will likely be many ways to approach this, the above is something I have done a lot to get around the possible days' waiting for replies. Prompt timeouts should, again IMO, be no longer than an hour. 


Happy to discuss further if you need !

0 Karma

mrzn
New Member

I have choose another option. I have created action to add workbook to container with only one action to run this last Playbook with Prompt inside. Now analyst can manualy and easy run playbook when he need.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...