Splunk SOAR

Prompt block: list choices from parameter?

Iñigo
Explorer

Hi

I've seen many recent changes on SOAR 6.3 regarding prompts, but I still don't see a way to define the allowed choices list as a parameter while creating a prompt block from the GUI.

Many times the options that are available to the user are dynamic, so hard-coding the choices list isn't practical for the user, is prone to get out of date and force playbook redeployments.

The only way I see so far is by using code blocks or by adding custom code to the prompt blocks (and losing the GUI handling in the process).

Is there any way I'm missing to get the question choices from a datapath or a custom list?

Labels (2)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@Iñigo you can already make dynamic list options in the prompts but you need to use custom code and bear in mind it "breaks" the VPE control of the prompt block.

You can use any of the API options to grab the dynamic fields you want to use then you just need to build the  choices variable in response_types and the prompt will show them. The issue you will have though is then how to handle the response if they are truly dynamic. i.e how would you know what they could choose to then handle the response. It can be done but needs to also be considered. 

    # responses
    response_types = [
        {
            "prompt": "",
            "options": {
                "type": "list",
                "choices": [
                    "a",
                    "b"
                ],
            },
        }
    ]



Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...