Splunk SOAR

Prompt block: list choices from parameter?

Iñigo
Explorer

Hi

I've seen many recent changes on SOAR 6.3 regarding prompts, but I still don't see a way to define the allowed choices list as a parameter while creating a prompt block from the GUI.

Many times the options that are available to the user are dynamic, so hard-coding the choices list isn't practical for the user, is prone to get out of date and force playbook redeployments.

The only way I see so far is by using code blocks or by adding custom code to the prompt blocks (and losing the GUI handling in the process).

Is there any way I'm missing to get the question choices from a datapath or a custom list?

Labels (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@Iñigo you can already make dynamic list options in the prompts but you need to use custom code and bear in mind it "breaks" the VPE control of the prompt block.

You can use any of the API options to grab the dynamic fields you want to use then you just need to build the  choices variable in response_types and the prompt will show them. The issue you will have though is then how to handle the response if they are truly dynamic. i.e how would you know what they could choose to then handle the response. It can be done but needs to also be considered. 

    # responses
    response_types = [
        {
            "prompt": "",
            "options": {
                "type": "list",
                "choices": [
                    "a",
                    "b"
                ],
            },
        }
    ]



Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...