Splunk SOAR

SOAR / Phantom creating 8 identical artifacts with the exception of tag value- Please advise

joconnor
Explorer

I've created an alert in Splunk Enterprise and used the Splunk SOAR / Phantom plugin to call the action "Run a playbook in Splunk SOAR". So far so good. Alert fires, it gets forwarded over to SOAR. SOAR creates a new event and then takes the original event data and creates an artifact with the details. And then changes the tag value and creates another artifact.... and another.... and another. 

Only one tag is assigned to each artifact, those being "endpoint", "filesystem", "os", "registry", "security", "success", "track_event_signatures", and "windows". 

I can't find any mention of these tags in any place, starting with the original data, to the Splunk enterprise alert config, etc. So I think it's. SOAR adding additional data, but again I'm not sure how or when or why it's doing that. If each tag is necessary is there a way I can force it to add all 8 tags to an array on a single artifact? Please advise.

Labels (1)
0 Karma
1 Solution

joconnor
Explorer

@phanTom Resolved. Discovered it to be a setting in the advanced settings under the Phantom/SOAR App for Splunk config. By default it divides multi-value fields to be created as separate artifacts, but in my case was creating too much redundancy.  Thanks for your time.

View solution in original post

0 Karma

joconnor
Explorer

@phanTom Resolved. Discovered it to be a setting in the advanced settings under the Phantom/SOAR App for Splunk config. By default it divides multi-value fields to be created as separate artifacts, but in my case was creating too much redundancy.  Thanks for your time.

0 Karma

phanTom
SplunkTrust
SplunkTrust

@joconnor what playbook(s) are you running?

The adding of tags is very likely performed by a playbook automation and yes you can add multiple tags but would need to reconfigure the automation to add multiple when it does it now.  

0 Karma

joconnor
Explorer

Right now I'm only calling an empty custom playbook that I created which essentially does nothing at this point. I've modified the on_start() method to use the phantom.collect method to retrieve all artifacts in the container and then output the contents in the debug window. Then it ends.

This is also only happening to the event that uses the alert action "Run Playbook in Phantom". I have other cases of a data model being forwarded and in similar circumstances, for the same event will only create a single artifact.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...