Splunk SOAR

Workbook Source Control

SOARt_of_Lost
Path Finder

Has anyone managed to set up source control for workbooks? 

Pulling the information down via API to upload to gitlab is straightforward. You can run a get request against [base_url]/rest/workbook_template (REST Workbook). The problem is with pushing information. As far as I've been able to find, you can only create new phases or tasks. You're not able to specify via name or ID that you want to update an object. There's also no way I've found to delete a phase or task which would make creating a new one more reasonable.

Labels (2)
0 Karma
1 Solution

SOARt_of_Lost
Path Finder

I managed to get this sorted out. With the way SOAR handles IDs, it's easiest to update workbooks as a whole than trying to focus on specific phases or tasks. To that end, when pulling your workbooks, you'll want to get

  • [base_url]/workbook_template?page_size=0 
  • [base_url]/workbook_phase_template?page_size=0.

Since they're stored separately you'll then want to stich the workbooks and phases together using the phases' template value. This is the same as its parent workbook's ID.

Including some fields in your push can cause SOAR to reject the changes (usually with a 404 error).

  • Workbooks (the top level): name, description, is_default, is_note_required, phases. 
  • Phases (the middle level): name, order, and tasks.
  • Tasks (bottom level): name, description, order, owner, role, sla, and suggestions.

Delete

I overcomplicated this for myself. A simple REST delete request to [base_url]/rest/workbook_template/[ID] will delete the workbook.

Create

Post your json with the required fields to [base_url]/rest/workbook_template. It's important to note there is no ID.

Update

Post your full json with the required fields for the workbook you're changing to [base_url]/rest/workbook_template/[ID]. SOAR is intelligent enough to recognize what the changes are and just update those pieces.

View solution in original post

0 Karma

SOARt_of_Lost
Path Finder

I managed to get this sorted out. With the way SOAR handles IDs, it's easiest to update workbooks as a whole than trying to focus on specific phases or tasks. To that end, when pulling your workbooks, you'll want to get

  • [base_url]/workbook_template?page_size=0 
  • [base_url]/workbook_phase_template?page_size=0.

Since they're stored separately you'll then want to stich the workbooks and phases together using the phases' template value. This is the same as its parent workbook's ID.

Including some fields in your push can cause SOAR to reject the changes (usually with a 404 error).

  • Workbooks (the top level): name, description, is_default, is_note_required, phases. 
  • Phases (the middle level): name, order, and tasks.
  • Tasks (bottom level): name, description, order, owner, role, sla, and suggestions.

Delete

I overcomplicated this for myself. A simple REST delete request to [base_url]/rest/workbook_template/[ID] will delete the workbook.

Create

Post your json with the required fields to [base_url]/rest/workbook_template. It's important to note there is no ID.

Update

Post your full json with the required fields for the workbook you're changing to [base_url]/rest/workbook_template/[ID]. SOAR is intelligent enough to recognize what the changes are and just update those pieces.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...