Splunk SOAR

Phantom: Asset environment variables

nhammSplunk
Explorer

Once the asset environment variables have been created (mySpecificKey -> mySpecificValue), how do I access these values inside a playbook? $ENV{'mySpecificKey'} does not seem to work.

Labels (2)
Tags (1)

rplas
Explorer

Asset environment variables are meant to override the global environment variables set for all apps. These are primarily used to designate proxy configurations.

Relevant doc pages:

0 Karma

nhammSplunk
Explorer

Thank you for the response, but this doesn't answer my question. If an Environment Variable is configured in an asset, how does that Environment Variable get called/reference in a playbook?

mzambrana123
Explorer

Is there a clear answer for this? My use case is the following. 

 

I want to call in an authentication header from the environment variable. Is this possible and if so how. There is not clear description here and the reference docs are not helpful. 

 

Thanks, 

willhart802
Engager

I have the exact same question. I want a place to store a password or API key and retrieve it. I don't want to store it in custom code or in the playbook.

This seems like a perfect place to put it.

sam_splunk
Splunk Employee
Splunk Employee

If the values to store aren't particularly sensitive you may consider them in a custom list.

I _believe_ the environment variables are only visible to the App itself, not the playbook executing the app. In other words, I don't believe its possible to have the playbook extract some custom environment variable that's configured within the app settings and then pass it to the app. Instead the App would have to know to use that variable.

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...