Splunk SOAR

Is there a way for us to check/test connectivity across a list of assets from within a playbook?

nongingerale
Explorer

Hi all - is there a way for us to check/test connectivity across a list of assets from within a playbook? I was looking through the documentation and haven't found information that says it is possible or not. I only see how to do it manually or with the rest api call app_status but no examples on how to use it within a playbook. Any help is appreciated!

0 Karma

phanTom
SplunkTrust
SplunkTrust

@nongingerale 

The 2 ways to get REST data in a playbook and use it are:

1. HTTP App 
2. phantom.requests.get()

You may have to jump through some other REST hoops to get what you want as the asset_status results have their own id with the asset_id as a field so you need to get the asset_id first. Then query asset_status to grab the data for the asset(s) you want to check. Then work out if the status is "success" or "failed" then <do something>

Personally I would use the phantom.requests.get() for this as it will give you more control and not make you need multiple playbook blocks. 

https://docs.splunk.com/Documentation/SOARonprem/6.0.2/PlaybookAPI/SessionAPI 

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...