Splunk SOAR

Create Ingest Action in Phanto App

jpferrero
Engager

Hello,

I'm trying to develop my first Phanto APP using the wizard. The integration is like a ticketing system and I want to implement an ingest action (on_poll). When I select this action and try to submit the App I get the following error:

jpferrero_0-1603373671283.png

What am I missing?

Thank yo very much.

Jose

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@jpferrero the `on_poll` action is one you can't configure in the Wizard (still not sure why it's there tbh). 

I order to build one I would recommend building the barebones in the wizard then review some of the apps here (https://github.com/phantomcyber/phantom-apps/tree/next/Apps) to see how the on_poll action is setup and look to replicate and tweak to your needs. Apps I know of with on_poll are JIRA & Proofpoint. There are likely more but these are ones I have used as templates in the past. 

Hope this helps? If so please provide Karma & if it answers your issue, please mark as a solution. 

Thanks.

View solution in original post

jpferrero
Engager

Thank you very much. I started coding the 'on-poll' function without using the wizard, but just to know if I was doing something wrong or was a Wizard related issue.

phanTom
SplunkTrust
SplunkTrust

@jpferrero the `on_poll` action is one you can't configure in the Wizard (still not sure why it's there tbh). 

I order to build one I would recommend building the barebones in the wizard then review some of the apps here (https://github.com/phantomcyber/phantom-apps/tree/next/Apps) to see how the on_poll action is setup and look to replicate and tweak to your needs. Apps I know of with on_poll are JIRA & Proofpoint. There are likely more but these are ones I have used as templates in the past. 

Hope this helps? If so please provide Karma & if it answers your issue, please mark as a solution. 

Thanks.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...