Splunk SOAR

Is there documentation on Code Block Self.Name type of param?

nongingerale
Explorer

Probably a silly question but for the life of me can't find documentation - when we create a code block, how do we call the the name of said code block? Currently want to add extra information in my error handling and want to include the name of the code block that it occurs under.

I tried variations of phantom.name, custom_function__name, custom_function.name/(), self.name, etc. Any help is appreciated!

Labels (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

Not sure about this one but would need to know more about how you are error handling at the moment?

The only way I can see is to have2 ouputs with an output containing the name of the code block hardcoded and if you are outputting a pass/fail you can also pass out the block name and then stitch together in your error handling?

-- Hope this helps, if so consider leaving some Karma. Even better is if this fixed your issue, that you mark as a solution for others to find. Happy SOARing!! ---
0 Karma

nongingerale
Explorer

I'd want to make things are generalized as possible and avoid hard-coding anything (for scalability and good coding practice reasons), so if I were to (for example) have a separate function that takes in a variable for the name and the "error message" to include that in part of error handling,

or similarly, if i were to incorporate simple try/except portions in my code where i want to include the name of the function (without hard coding the name)

is that possible? currently I have things hard coded and the pass/fail option doesnt meet this need. If its not implemented then its definitely something that would be useful in later iterations of Phantom since itll help debugging (hardcoding the name at the moment is ok but not scalable)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...