Splunk SOAR

How to decrypt the password from the asset, while developing a custom app?

victor_menezes
Communicator

Hi everyone,

I'm looking for a solution here while playing around with the app builder on SOAR, and I could get the asset interface work fine and from the code I can get the values from there, but the password type returns as an encrypted string instead (as the field is a password field).
How can I decrypt it so the code can use that value in runtime accordingly?

Labels (3)
1 Solution

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

View solution in original post

phanTom
SplunkTrust
SplunkTrust

This is a bug and is resolved in the latest version past 5.3.x 

One way is to publish and test, or another is to hardcode the relevant details in whilst using the IDE, then remove before publishing. This will allow for the use of the IDE whilst testing but you need to remember to remove before publishing. 

0 Karma

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

victor_menezes
Communicator

Thanks @hariomenkel. Works like a charm!

0 Karma

scorsatto
Explorer

Thank you for this, I was having the same issue. Indeed we can only test the asset user/password after we install the app. this is an improvement opportunity I would say for SOAR, as we can't test it before deploy the app

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...