I just recently completed the Phantom Admin and Playbook Development training and am in the process of using what I've learned to setup Phantom to be the SOAR platform for notable events generated in ES. I'm having problems getting the Update Event action in Phantom's builtin Splunk app to update the status of the ES Notable event after it has been pushed to Phantom as a new container. Here are the description of the use case and the issue: After experimenting with the various methods of getting Notable Events to Phantom, I've settled on the Event Forwarding option to "push" notable events to Phantom. I'm having problems getting the playbook to update Notable Event status on ES, and I'm wondering if anyone can help me debug this playbook? FYI, for the lab environment, I'm using Splunk 8.0.1, ES 6.1.1, Phantom Add-On 3.0.5 and Phantom Community Edition 4.8.24304; all are the latest versions as of 5/25/20. My use case for the playbook is as follows: 1 - ES Correlation Search creates notable Events 2 - Phantom Add-On for Splunk's Event Forwarding enabled to forward new notable events to Phantom Because I need to have Phantom update the Notable Events later, the SPL used by Event Forwarding process have the following additional field mappings defined: (Showing the Splunk fields mapped to the custom fields I created in Phantom) event_id -> notableEventId severity -> notableSeverity urgency -> notableUrgency 4 - New containers created in Phantom with the above 3 fields as artifacts 5 - As new containers are created using this method, I want to use a playbook to update the Severity to match the Urgency from the notable event because Event Forwarding hard codes the severity. I also want the playbook to update the original Notable Event with quick comment and change the Notable status to "In Progress". The playbook's flow is as follows: 1 - Filter block #1: artifact:*.cef.notableEventId != blank 2 - Filter block #2: artifact:*.cef.notableUrgency != blank 3 - Decision block with 5 outputs for each of the 5 Notable Urgency values For each urgency: 4 - API block to change the container severity to match the Urgency value 5 - Format block to create a comment to the Notable Events 6 - API block calling "update event" action to update the ES Notable event using the following: event_ids = artifact:*.cef.notableEventId owner = unassigned status = in progress integer_status = leave blank urgency = artifact:*.cef.notableUrgency comment = format_1:formatted_data.* I tested the playbook and the debugger showed all the blocks functioned as expected except the last API block where it returns the following error and a FAILED status: May 25 2020 19:04:46 GMT-0400 (Eastern Daylight Time): phantom.act(): 'update_event_2' cannot be run on asset 'splunkmjp'. The "update event" action requires the following parameters: event_ids. The given parameters look like they were automatically generated by phantom.act() because an empty parameters list was passed to phantom.act(). The parameters list may have been empty because the preceding call to phantom.collect2() returned an empty list. Check your calling code in the action that generated this error This looks like the Splunk API block is missing the event_ids field, but the playbook's supposed to feed the value from the collection's artifact:*.cef.notableEventId field. I know that field's populated because there's a filter block that verifies that this field is populated. Debugger also confirmed that the filter condition is valid with the following 2 lines: Mon May 25 2020 19:04:46 GMT-0400 (Eastern Daylight Time): phantom.condition(): condition loop: condition 1, 'A1846671-F6A2-41EC-B0F9-E138A5837C00@@notable@@31ed12911128e0f233ba2bea38f4d3a8' '!=' '' => result:True Mon May 25 2020 19:04:46 GMT-0400 (Eastern Daylight Time): phantom.condition(): returned 1 filtered artifacts AND 0 filtered action results What am I missing that's preventing the Update Event action to work? Any suggestions or tips would be greatly appreciated! Thanks in advance. In case you want to ask "why am I even bother with this use ease". This answer is that this is my interpretation of the Splunk ES and Phantom integration. I want to be able to use Phantom to collect evidence, conduct additional searches and close the incident or case. Then at the same time synchronize the incident status and owner with the associated Notable Event in ES. I'm experimenting using playbook to do the updates in ES to learn about playbook design. ... View more

I'm looking to add a REST API input to pull data from a vendor that we work with. I'm having issues getting the authentication part working in the rest_ta app, and am looking for help debugging this. This vendor's API requires me to connect twice. The first time to login to obtain an authentication token. Then use that token in the second connection to run the actual API command. Here are the 2 connections if I use curl: curl -k -v POST "https://xyzcompany.example/rest/v1/login" -H "accept: application/json" -H "Content-Type: application/json" -d "{ 'clientId': '1234', 'userName': 'myUserName', 'password': 'myPassw0rd', 'isEncryptedPassword': 'false'}" In the returned data, look for the "Authorization: Bearer ..." string > POST /rest/v1/login HTTP/1.1 > Host: xyzcompany.example > User-Agent: curl/7.58.0 > accept: application/json > Content-Type: application/json > Content-Length: 116 > * upload completely sent off: 116 out of 116 bytes < HTTP/1.1 200 OK < Server: Apache-Coyote/1.1 < Authorization: Bearer aLongRandomStringOfText < Content-Length: 0 < Date: Mon, 15 Apr 2019 13:57:01 GMT < * Connection #1 to host xyzcompany.example left intact Use the Authorization: Bearer string to run, for example, a GET /events command: curl -X GET "https://xyzcompany.example/rest/v1/events/" -H "accept: application/json" -H "Content-Type: application/json" -k --header "Authorization: Bearer aLongRandomStringOfText" This should return a list of events in JSON format that I want to index in to Splunk. I'm able to use the rest_ta app to create a new data input stanza as follows: [rest://XYZ GET All Events NoAuth] activation_key = myActivationKey auth_type = none endpoint = https://xyzcompany.example/rest/v1/events/ http_header_propertys = Authorization=Bearer aLongRandomStringOfText http_method = GET index_error_response_codes = 1 response_handler = response_type = json sequential_mode = 0 sourcetype = ntt:event streaming_request = 0 cookies = JSESSIONID=D07F70A3AC3821C15EE462DFFEB91009.10.250.74.10 disabled = 0 This only works if I manually generate the Authentication Bearer key and paste it to the HTTP Header Properties field. The problem is the key expires after 8 hours, so I have to manually update the key to get new data. In order to have Splunk automate this, I understand I need to create a custom Authentication Type in the authhandlers.py file. I found some sample code from Answers from users doing similar type of API calls, but the custom handler errors out for me. I'm a bit stuck at this point and am hoping to find help to debug this for me. To use the custom Authentication Handler, I modify the input stanza to add the "XYZAuthHandler" custom type. Then in the Custom Authentication Handler Arguments, I typed in "password=myPassw0rd" (without the quotes). This is so that when I change the password, I don't need to modify the authhandler.py file. Here is the snippet of code that's in my authhandlers.py file. from requests.auth import AuthBase import hmac import base64 import hashlib import urlparse import urllib import requests import json #add your custom auth handler class to this module class XYZAuthHandler(AuthBase): def __init__(self,**args): self.password = args['password'] pass def __call__(self, r): url = 'https://xyzcompany.example/rest/v1/login' data = { 'clientID':1234, 'userName':'myUserName', 'password':self.password, 'isEncryptedPassword':'false', } req_args = {"verify" : False} headers={'Content-Type':'application/json'} auth_response = requests.post(url,data=json.dumps(data),headers=headers,**req_args) response_json = json.loads(auth_response.text) token_key = response_json["Authorization"] r.headers['Authorization'] = token_key return r class MyEncryptedCredentialsAuthHAndler(AuthBase): [snip] I've verified that there are no mixture of spaces and tabs to indent the code. All the indents are space characters. The error I'm getting from _internal index is: 04-25-2019 22:38:01.712 -0400 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: 'Authorization' "Authorization" is suppose to be the key to parse out the authentication token, but it looks like it's being treated like an "action" of some kind. I'm not sure how to fix this.... This is really my first time working in Python, so I hope the code I found is actually working for what I need to do. They looked OK from me Googling for those specific Python syntax, which is about as far as I can take from what I know of Python. Any help debugging this would be greatly appreciated. Thanks! ... View more