Splunk Phantom- How to monitor health of playbook?

[Manojsai_3]

Hi fellas, How can we fetch details of a playbook like action_run_id, playbook_run_id and status. We need to monitor health of a playbook with those data. If anyone have any ideas please help me out.

[victor_menezes]

Hey Manoj,

You have two options:

You can use an external search configuration to stream phantom data to Splunk and get that information on phantom_action_run or phantom_app_run indexes. I particularly use this one, and I see that phantom_action_run has the info you want to see.

OR

You can query Phantom REST api directly to get that information using the endpoints action_run, app_run or playbook_run for example. (https://docs.splunk.com/Documentation/SOARonprem/5.3.3/PlatformAPI/RESTQueryData)