Splunk SOAR

Pass format block data to subplaybook

shaquibk
Explorer

Hi Team,

I want to know if it is possible pass data present in a format block of one playbook to another playbook being called. So its like

PB1--->Format block -------> PB2 called ------>PB2 performs functions on the previous format block data.

I know as a workaround this can be done by adding an artifact and using it in subplaybook. But would prefer if it is possible without it.

Kindly let me know if any further info is required.

Thanks in advance!

Regards,

Shaquib

Labels (1)
Tags (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@shaquibk you could look to use phantom.save_object() and phantom.get_object() to save and retrieve the formatted string in another playbook. Not sure if the process will mess with formatting but they will certainly persist the formatted data string for re-use.

save_object() : https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/DataManagementAPI#save_object 

get_object(): https://docs.splunk.com/Documentation/Phantom/4.10.7/PlaybookAPI/DataManagementAPI#get_object 

Happy Phantoming!

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...