Solved: Re: Running a playbook without Event id?

ansir · ‎01-16-2023

Hi,

i'm trying to create a set of playbooks to unit test other playbooks.

is it possible to run a playbook without providing an event id?

thanks.

Ansir

phanTom · ‎01-16-2023

@ansir a playbook must have either a container id or artifact id to run against.

You can have an empty event generated by a timer app which will kick a playbook (set to active) off then you could populate the event before running through the playbook(s) you are wanting to test!

Hope this helps! Happy SOARing!

-- Hope this helps, if so consider leaving some Karma. Even better is if this fixed your issue, that you mark as a solution for others to find. Happy SOARing!! ---

View solution in original post

phanTom · ‎01-16-2023

@ansir a playbook must have either a container id or artifact id to run against.

You can have an empty event generated by a timer app which will kick a playbook (set to active) off then you could populate the event before running through the playbook(s) you are wanting to test!

Hope this helps! Happy SOARing!

-- Hope this helps, if so consider leaving some Karma. Even better is if this fixed your issue, that you mark as a solution for others to find. Happy SOARing!! ---

Running a playbook without Event id?

using SOAR ⁄ Phantom

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation