Hi all,
I am integrating a Splunk form/dashboard with SOAR, where I use "sendtophantom" to create a container on which a playbook needs to run.
However, what I am noticing is that when the container has multiple artifacts, the playbook takes all the artifacts' CEF fields and combines them into one, which then causes havoc with my playbooks. I have considered changing the ingest settings to send MV fields as a list instead of creating new artifacts, but this will break too many other playbooks, so it isn't an option right now.
My flow is basically as follows:
- Container gets created with information coming from splunk
- artifact(s) contain subject and sender email information
- Playbook needs to run through each artifact to get the subject and sender info
- Playbook processes these values
Is there a way to specify that a playbook must run against each artifact in a container individually, or another way to alter the datapaths in the VPE to run through each artifact?
