Splunk SOAR

Is it possible to add custom fields to a splunk phantom container schema programmatically?

ebarrameda
New Member

I am developing a Splunk SOAR app that retrieve a json from our backend and ingest it into a container in splunk soar. However, I need to show some fields that are not included in the container schema and i want those custom fields to be deployed with my app. Therefore my question, Is it possible to add custom fields to a splunk phantom container schema programmatically so our customers do not need to create them manually in the Splunk SOAR user interface?

Labels (3)
0 Karma

JackTheRipper
Loves-to-Learn

Have you thought about using the container API?

phantom.add_artifact(container=None, raw_data=None, cef_data=None, label=None, name=None,
    severity=None, identifier=None, artifact_type=None,
    field_mapping=None, trace=False, run_automation=False)

 

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...