Splunk SOAR

Phantom Playbook calling playbook block synchronous

dphegarty
New Member

I have a top level playbook that calls two playbooks, on that does some analysis and the second one that promotes the event to a case based on artifacts created by the first playbook and it does not appear to honor the Synchronous flag

Playbook 1
Calls Playbook A that does some analysis
Playbook A calls Playbook B based on some indicators to query Splunk for additional data and adds new artifacts.
Calls Playbook C that will promote the event to a case and send out email notifications based on data in the artifacts'

All the Playbook blocks have Synchronous turned on and yet the Playbook C runs immediately after Playbook A launches. Playbook C does not wait for Playbook A to finish .

I've created some simple Playbooks to test Synchronous and it does not appear to exhilarate the behavior stated in the documentation:

To set the called playbook to run in synchronous mode, click the Synchronous toggle. This makes the calling playbook wait for the called playbook to complete before continuing

What am I missing ?

Labels (2)
Tags (1)
0 Karma

dphegarty
New Member

Found the answer to this issues. There can not be multiple paths to the "End" block within the playbook that can evaluate to true. Multiple paths run in parallel and as long as one path reaches the end block the playbook is considered completed even if another path is still running.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...