Splunk SOAR

Is there a way to catch errors coming from custom function block?

GeorgeOrwell
Explorer

Currently when I want to catch errors coming from arbitrary action block I rely on phantom.get_summary() looking at action status. But I notice that Custom Function blocks cannot be found there, so my question is how do I check the status of a Custom Function block, and catch errors originating there

Labels (2)
0 Karma
1 Solution

phanTom_old
SplunkTrust
SplunkTrust

There are two ways to handle any issues/errors from custom functions:

1. Move the CF code into apps so that they can be part of the summary at the end. (I have just done this for one of my customers but for efficiency rather than this issue).

2. Handle any possible issues in the function code and have an output of "status" and/or "message" and handle it in the playbook. This still won't appear in the summary but will let you know if any CFs had an issue. 

 

Happy SOARing!

View solution in original post

phanTom_old
SplunkTrust
SplunkTrust

There are two ways to handle any issues/errors from custom functions:

1. Move the CF code into apps so that they can be part of the summary at the end. (I have just done this for one of my customers but for efficiency rather than this issue).

2. Handle any possible issues in the function code and have an output of "status" and/or "message" and handle it in the playbook. This still won't appear in the summary but will let you know if any CFs had an issue. 

 

Happy SOARing!

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...