Yep, you'll have to have separated calls for that. Filters on SOAR REST can be appended but they will work as "AND" condition as "OR" is not supported in that sense as a limitation on Django querysets 😞 So the easiest way would be to combine the results of https://<your_soar_instance>/rest/container?_filter_name__icontains="computer" and the ones from https://<your_soar_instance>/rest/container?_filter_name__icontains="process" and finally process then accordingly.   ... View more

Hey @meshorer ,   Have you tried to ssh to your Phantom/SOAR server and run this? phenv set_preference --indicators yes This should be enough to reenable the indicators for you. Once executed please allow it up to 5 minutes for the system to start the indicators again. ... View more

Awesome! Glad to know that. Please remember to mark this as resolved so others can know about it. Happy splunking! ... View more

A quick win will be tagging the container. You can edit your playbook to check if the tag of the container is XYZ, which will be not in the first run (for the first artifact). Once you call your action to create an incident, change the tag of the container to XYZ, so even if the next artifact triggers the playbook, the tag will already by XYZ and the create incident action will not be called as it will not satisfy your condition. While creating artifacts manually (via rest, for example), you can force the parameter "run_automation" to false, preventing that new artifact to trigger the playbook execution, but in your case data is coming from the export app so maybe you can find some settings in there to change this behavior (honestly I don't recall one, but maybe you can find something interesting) ... View more

Your props is not matching the stanza name of transforms. Not sure if that was a typo... About a typo, you don't need that first pipe in the ingest_eval. Try this instead (I changed the regex a bit) Props.conf: [your_sourcetype] TRANSFORMS-set_time = set_time_from_file_path Transforms.conf [set_time_from_file_path] INGEST_EVAL = eval _time = strptime(replace(source, ".*/ute-(\\d{4}-\\d{2}-\\d{2}[a-z]+)/([^/]+/[^/]+).*","\\1"), "%Y-%m-%d_%H-%M-%S") ... View more

Hey Ricky, AFAIK maxWarmDBCount doesn't affect the rollover of data (but it can be storage hungry so be careful with that), it is something the frozenTimePeriodInSecs do instead. In your case, if I understood correctly, the frozen time already passed but your data did not rolled over, and that may be either because your cluster manager is too busy at the moment (and you are experiencing delay in this processing) OR maybe it is waiting for the buckets to hit a threshold in size. Check the bucket replication status also, it may indicate if there is any problem in there... Are you using maxTotalDataSizeMB key by any chance? Try to add that also to see if you get any diff behavior. ... View more

I have this integration working on my environment and it works like a charm! Just keep in mind that the user you configure in the add-on to be used in this integration must have access to ServiceNow to read/write the proper tables that you want to interface (events, incidents, etc). In my case, our API users that are given by ServiceNow don't have access to the UI for security purposes, so I wasn't able to make the configuration via Add-On UI as it returns HTTP 400 status, but if you do the configuration via conf file it goes just fine. Today I use this add-on to ingest data from ServiceNow to Splunk (incidents, requests, changes, cmdb) and also to create incidents on ServiceNow from Splunk alerts via alert action. ... View more

Not really. That's just an overall count of ingested events. I'm looking more at the DB level because I suspect that there is something "stuck" in DB side, so something like table sizes and etc. ... View more

Try to create a child playbook that has a custom function and then the SNOW app ahead of it. So you can call this child playbook passing only the fields that can be dynamic, and the child playbook will append those to the hard coded fields (like your Incident Category) and then pass those to the SNOW app action that you want to call. Have you explored that option? ... View more

Hey @dbkuhn , There is any change of sharing this query?  Also, how did you cleaned up this indicator you mentioned? I tried to do the cleanup via delete_containers.py and when I started vacuum process if filled up the disk as it needs kinda of the same amount of data to dispose in disk to process, so it was worse than I thought and now my dev environment is down with 20kb free space in the mount. I'll have to struggle here to try to expand the mount first in order to be able to re-start the db and start the vacuum again. ... View more

Hey @ouss , Sorry to revive this but did you find anything? I'm going thru the same situation here, no luck on finding answers yet. ... View more

It looks like you're sending HTML emails and that black diamont is basically charset mismatch between source and destination (the string send to the body VS the email server I mean), so in those emails you have that character displayed, that means the playbook got a string that has special encoded characters on that and it don't match the expected encoding from your mail server. If you don't need HTML, just send it as text (send rawemail action). If you do need HTML emails (send htmlemail action), try to change the encoding asset configuration flag to true/false depending if you are using unicode characters or not. Finally you can also add the charset at the header of your HTML message body if you are for sure using HTML code in text. Check that and see if you have any different behavior ... View more

Thanks @hariomenkel. Works like a charm! ... View more

I'm following this thread, Nareerat. I had a similar problem recently but it seems to self recover and start sending data again, but during the "gap" we don't get the updates until I reindex the data, but eventually if it keeps stopping then that can cause some problems. ... View more

Hey Manoj, You have two options: You can use an external search configuration to stream phantom data to Splunk and get that information on phantom_action_run or phantom_app_run indexes. I particularly use this one, and I see that phantom_action_run has the info you want to see. OR You can query Phantom REST api directly to get that information using the endpoints action_run, app_run or playbook_run for example. (https://docs.splunk.com/Documentation/SOARonprem/5.3.3/PlatformAPI/RESTQueryData) ... View more