Is it possible to add a task in phase of a workbook in a particular container via api?

[ansir]

Hi,

is it possible to add a task in a phase of a workbook in a particular container via an api call?

thanks for the help.

[phanTom]

@ansir you can use the phantom.add_task() API: 
 https://docs.splunk.com/Documentation/SOARonprem/5.4.0/PlaybookAPI/ContainerAPI#add_task 

However, this doesn't provide many options so I like to use REST:
https://docs.splunk.com/Documentation/SOARonprem/5.4.0/PlatformAPI/RESTWorkbook#.2Frest.2Fworkbook_t... 

-- If this solved your issue please mark as a solution! Happy SOARing! --

[ansir]

Hi thanks for your quick repose. 

can you give an example of a post request to add task to existing phase within a particular container?

regards, 

[phanTom]

@ansir did you check the docs links? The example is in there:

{
	"name": "My Task",
	"order": 1,
	"owner": 2,
	"phase_id": 20,
	"description": "Investigate the event",
	"playbooks": [{
			"scm": "local",
			"playbook": "investigate"
		},
		{
			"scm": "community",
			"playbook": "04_07_2017 - PhishMe"
		}
	],
	"actions": ["geolocate ip", "block_ip"]
}'

[ansir]

hi,

i have used the get_phase api to get the id of a phase of a particular container.

id = phantom.get_phase(container=id_value, trace=False)

which returned id 94734,

then i did the following post request: 

`

{"name": "new task",
"order": 2,
"phase_id": 94734,
"description": "test description",
"playbooks": [{}],
"actions": []}

`

 to the  "workbook_task_template endpoint"  to add a task to phase_id 94734.

I'm getting the following failed response

: {\"failed\": true, \"message\": \"Invalid value \\\"94734\\\" for parameter \\\"phase_id\\\"\"}"}]

not sure why this is the case since the phase id currently exist.

[phanTom · Accepted solution]

That should work.

Here is a screenshot of the code I use in a CF:

The only difference I can see is that I specify int() for the phase_id value.

-- If this solves your issue please mark as a solution. Happy SOARing! --