Splunk SOAR

Prompt block: list choices from parameter?

Iñigo
Explorer

Hi

I've seen many recent changes on SOAR 6.3 regarding prompts, but I still don't see a way to define the allowed choices list as a parameter while creating a prompt block from the GUI.

Many times the options that are available to the user are dynamic, so hard-coding the choices list isn't practical for the user, is prone to get out of date and force playbook redeployments.

The only way I see so far is by using code blocks or by adding custom code to the prompt blocks (and losing the GUI handling in the process).

Is there any way I'm missing to get the question choices from a datapath or a custom list?

Labels (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@Iñigo you can already make dynamic list options in the prompts but you need to use custom code and bear in mind it "breaks" the VPE control of the prompt block.

You can use any of the API options to grab the dynamic fields you want to use then you just need to build the  choices variable in response_types and the prompt will show them. The issue you will have though is then how to handle the response if they are truly dynamic. i.e how would you know what they could choose to then handle the response. It can be done but needs to also be considered. 

    # responses
    response_types = [
        {
            "prompt": "",
            "options": {
                "type": "list",
                "choices": [
                    "a",
                    "b"
                ],
            },
        }
    ]



Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...