Container data vs Custom Application Results

[scorsatto]

I'm creating a custom application in SOAR and one of the fields this custom application provides is a password information, for obvious reasons, I don't want to store the password in the container, rather I just would like to add it in a parameter that I can use during playbook execution only. is there any way I can do it?

Version: Splunk SOAR 5.2.1.78411

What I'm doing today in my custom app is:

if secret_value:
          self.save_progress("Secret value retrieved successfully")
          action_result.add_data({"succeeded": True, "secret_value": secret_value})
         return action_result.set_status(phantom.APP_SUCCESS, 'Successfully retrieved secret value')

but the secret value is saved in the container.

[scorsatto · Accepted solution]

yup, I'll need to use a hashing.. I would be great to have this such functionality in the app development, like a new command to pass the results only without save the data to the container.

Thanks @phanTom for your help!

[phanTom]

@scorsatto if you are using either CyberArk/Hashicorp/Thycotic then the platform already supports that for application assets to be able to retrieve the password(s) from a vault for one time use only. 

If you are not using any of the above then I think the hashing is your best way. 

-- If this resolved your issue please mark as a Solution! Happy SOARing --

[phanTom]

@scorsatto if you add to action_results then it will be included in the JSON added to the container and there is no real way around it. You could hash it and then decode in the playbook when you need it?

I would like to understand what the app does a bit more as to why you would pass a secret out for playbook use when you can just create an app and use it in a playbook and keep the secret/password in the app config where it's already hidden. 

[scorsatto]

Hello @phanTom, the app will be used to retrieve secrets from another tool like passwordVault, if there is no other alternative, I think I'll have to hash the password to avoid any exposures.