@CS_ If you are doing so in a script right now then I think your best and quickest option is to update the app? I assume you already know the required endpoint(s) and data to perform the required update so you should be able to "stitch" it into the existing app? Hope this helps! Tom ... View more

That should work. Here is a screenshot of the code I use in a CF:   The only difference I can see is that I specify int() for the phase_id value. -- If this solves your issue please mark as a solution. Happy SOARing! -- ... View more

@ansir  {"content": "<updated_note_content>"} Then POST back to the /rest/note/<id> and it will update. I just tested it using POSTMAN and it worked as expected. If you don't get the original then it will overwrite to be aware of that.  -- If this resolved your issue please mark as a solution! Happy SOARing! -- ... View more

This issue has been resolved in the latest version:  2022-10-14 PSAAS-10340 Screenshot Machine app does not show screenshot in app widget after running action https://docs.splunk.com/Documentation/SOARonprem/5.4.0/ReleaseNotes/FixedIssues  ... View more

@wstutzman unfortunately the only way to do this would be to generate the number of containers needed to meet the number parity of the other platform. You can create and then delete all using REST: https://docs.splunk.com/Documentation/SOARonprem/5.3.5/PlatformAPI/RESTContainers    -- If this solved the issue please mark as the solution! Happy SOARing -- ... View more

@ben_r loops are not supported, yet, in playbooks but I would expect is on a roadmap somewhere as the community has been asking for a while! There is also no "retry n times on failure", but this could be written in to the app but you would need to let the app know how to determine the invalid response.  It depends on how you are determining a "valid response" but if you only need to try a max of 3 times, for now, and to keep your playbook "clean" from too much custom code, I would just have the action, followed by a decision 3 times. If the 1st action is "invalid response"  in the decision block, call the 2nd action block and so on.  Loops can be done but you need to edit a lot of the code to make it work and it's not really best practise to do it like that.  ... View more

@rivaanb  SOAR already uses loops to build parameter lists to pass into actions. Once you understand how the platform passed information into and out of actions it's not too bad 😄  It depends where you are getting the id's but, if you can build a list of id's to pass into 'get_file' in a Code Block, output them as a python list, then pass into a format block: %% {0} %% 0 = your python list of id's Then in the 'get_file' action use the '...formatted_data.*' output from the format block, you will see SOAR create a for loop and loop through each value, add it to a parameters list then call the action.  I suspect the get_file will then just provide a vaultId for the file(s) it got. If so then you just need to pass those vaultId values to your input-playbook.  The prompt is tricker and IMO If there is a lot of enrichment data I usually add note(s) to a task and then provide a "determination playbook" for the user to run once they have read and understood the note(s). This stops the automation hanging waiting for a prompt response and makes the system more efficient from my exp. Happy SOARing - If this helped please mark as a solution or feel free to ask more questions.  ... View more

@peterng_ unfortunately not as they are setup differently so even a "save_as" won't allow you to change the playbook type.  In this case you will need to re-draw the playbook in the relevant playbook type but only if the playbook requires input variables, otherwise the automation type is still relevant.  -- Happy SOARing, if this helped please mark as a solution -- phanTom ... View more

There are two ways to handle any issues/errors from custom functions: 1. Move the CF code into apps so that they can be part of the summary at the end. (I have just done this for one of my customers but for efficiency rather than this issue). 2. Handle any possible issues in the function code and have an output of "status" and/or "message" and handle it in the playbook. This still won't appear in the summary but will let you know if any CFs had an issue.    Happy SOARing! ... View more