Splunk SOAR

How to decrypt the password from the asset, while developing a custom app?

victor_menezes
Communicator

Hi everyone,

I'm looking for a solution here while playing around with the app builder on SOAR, and I could get the asset interface work fine and from the code I can get the values from there, but the password type returns as an encrypted string instead (as the field is a password field).
How can I decrypt it so the code can use that value in runtime accordingly?

Labels (3)
1 Solution

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

View solution in original post

phanTom
SplunkTrust
SplunkTrust

This is a bug and is resolved in the latest version past 5.3.x 

One way is to publish and test, or another is to hardcode the relevant details in whilst using the IDE, then remove before publishing. This will allow for the use of the IDE whilst testing but you need to remember to remove before publishing. 

0 Karma

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

victor_menezes
Communicator

Thanks @hariomenkel. Works like a charm!

0 Karma

scorsatto
Explorer

Thank you for this, I was having the same issue. Indeed we can only test the asset user/password after we install the app. this is an improvement opportunity I would say for SOAR, as we can't test it before deploy the app

0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...