Splunk SOAR

Container data vs Custom Application Results

scorsatto
Explorer

I'm creating a custom application in SOAR and one of the fields this custom application provides is a password information, for obvious reasons, I don't want to store the password in the container, rather I just would like to add it in a parameter that I can use during playbook execution only. is there any way I can do it?

Version: Splunk SOAR 5.2.1.78411

What I'm doing today in my custom app is:

if secret_value:
          self.save_progress("Secret value retrieved successfully")
          action_result.add_data({"succeeded": True, "secret_value": secret_value})
         return action_result.set_status(phantom.APP_SUCCESS, 'Successfully retrieved secret value')

but the secret value is saved in the container.

 

Labels (2)
0 Karma
1 Solution

scorsatto
Explorer

yup, I'll need to use a hashing.. I would be great to have this such functionality in the app development, like a new command to pass the results only without save the data to the container.

Thanks @phanTom for your help!

View solution in original post

0 Karma

scorsatto
Explorer

yup, I'll need to use a hashing.. I would be great to have this such functionality in the app development, like a new command to pass the results only without save the data to the container.

Thanks @phanTom for your help!

0 Karma

phanTom
SplunkTrust
SplunkTrust

@scorsatto if you are using either CyberArk/Hashicorp/Thycotic then the platform already supports that for application assets to be able to retrieve the password(s) from a vault for one time use only. 

If you are not using any of the above then I think the hashing is your best way. 

-- If this resolved your issue please mark as a Solution! Happy SOARing --

0 Karma

phanTom
SplunkTrust
SplunkTrust

@scorsatto if you add to action_results then it will be included in the JSON added to the container and there is no real way around it. You could hash it and then decode in the playbook when you need it?

I would like to understand what the app does a bit more as to why you would pass a secret out for playbook use when you can just create an app and use it in a playbook and keep the secret/password in the app config where it's already hidden. 

0 Karma

scorsatto
Explorer

Hello @phanTom, the app will be used to retrieve secrets from another tool like passwordVault, if there is no other alternative, I think I'll have to hash the password to avoid any exposures.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...