Splunk SOAR

How to handle Dynamic Assets in playbooks?

Dave_Burns
Path Finder

Just came across an interesting use case, and I'm wondering how people solve it. 

Phantom talks to an internal asset via HTTP and API key.

This asset has redundancy, and if it goes down a backup comes online. Part of that is name re-direction. The data underneath is all the same but the API key changes. 

My thought would be to perform a test connectivity check at the top of the playbook, and then pass the asset number down the playbook. 

Is there a smarter way to handle this? 

Thanks!

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...