Splunk SOAR

How to decrypt the password from the asset, while developing a custom app?

victor_menezes
Path Finder

Hi everyone,

I'm looking for a solution here while playing around with the app builder on SOAR, and I could get the asset interface work fine and from the code I can get the values from there, but the password type returns as an encrypted string instead (as the field is a password field).
How can I decrypt it so the code can use that value in runtime accordingly?

Labels (3)
1 Solution

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

View solution in original post

phanTom
SplunkTrust
SplunkTrust

This is a bug and is resolved in the latest version past 5.3.x 

One way is to publish and test, or another is to hardcode the relevant details in whilst using the IDE, then remove before publishing. This will allow for the use of the IDE whilst testing but you need to remember to remove before publishing. 

0 Karma

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

victor_menezes
Path Finder

Thanks @hariomenkel. Works like a charm!

0 Karma

scorsatto
Explorer

Thank you for this, I was having the same issue. Indeed we can only test the asset user/password after we install the app. this is an improvement opportunity I would say for SOAR, as we can't test it before deploy the app

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...