Splunk SOAR

Running a playbook without Event id?

ansir
Explorer

Hi,

i'm trying to create a set of playbooks to unit test other playbooks.

 

is it possible to run a playbook without providing an event id?

 

thanks.

 

Ansir

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@ansir a playbook must have either a container id or artifact id to run against. 

You can have an empty event generated by a timer app which will kick a playbook (set to active) off then you could populate the event before running through the playbook(s) you are wanting to test!

 

Hope this helps! Happy SOARing!

 

View solution in original post

0 Karma

phanTom
SplunkTrust
SplunkTrust

@ansir a playbook must have either a container id or artifact id to run against. 

You can have an empty event generated by a timer app which will kick a playbook (set to active) off then you could populate the event before running through the playbook(s) you are wanting to test!

 

Hope this helps! Happy SOARing!

 

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...