Hi Alex, Yes it is possible as indicated in the above post, you need to use rest calls. I have done this by creating a python script to(create containers / run playbooks etc...) Just curious why does it needs to be run this way? I'm just thinking that it might be more of a overhead to manually input details, including identifying which Phantom container where the playbook will run... Just my 2 cents, If you are 100% sure you want to run playbooks on specific scenarios, you can probably design this playbook to run against a specific label, and design it to automatically get details on a the container (e.g. destinationHostName) and automatically trigger an action against that (e.g. get triage / contain). That way, there's no need for manual intervention...   Cheers, Carl ... View more

Yep, assigning the literal value with an eval beforehand definitely works, and that's how I have it currently running, but I was hoping I could avoid that step. The docs only refer to a field value being used in the command and not a string, so I agree, it may be unsupported. ... View more

I know it's a few months after you asked, I had the same issue  first I found out you'll need a new artifact created, I still can't find how to do this automatically. I'm running an splunk query for URL and then adding them to the artifacts. then in the options you'll need to add  source_data_identifier --> the name you want cef_name--->  in my example i use artifact:*.cef.requestURL cef_value ---> Splunk_Query:action_result.data.*.url      (this is where the result of the investigate action)   And that's it. You can test it by run an manual action within the container and check if it works ... View more

The app appears to fail when wgetting an Internet resource that doesn't have a file extension. So a URL that ends in .htm or .txt or .jpg works fine, but something like pastebin[.]com/raw/dStYKpUb (a chocolate chip cookie recipe) fails. Maybe it's treating the filename as a folder since it doesn't have an extension, but I'm still researching: {"app_name":"wget","asset_name":"wget","param":{"context": {"guid": "XXX", "artifact_id": 0, "parent_action_run": []}, "target_url": "https://pastebin.com/raw/dStYKpUb"},"status":"failed","message":"handle_action exception occurred. Error string: '[Errno 2] No such file or directory: '/opt/phantom/vault/tmp/pastebin_12-10-2019_09-16-09.com/raw/dStYKpUb''"}] ... View more

@AlexBryant Thank you for detail explanation ... View more

Simple and works perfectly - thanks! ... View more

One approach would be to set the alert action for your search to a script. The script can then send you an email and also interact with Splunk via the REST API. http://dev.splunk.com/view/SP-CAAADQ5 provides an example for disabling a search via the API: curl -k -u admin:changeme -d "disabled=1" -d 'search="fail+OR+error"' https://localhost:8089/servicesNS/admin/search/saved/searches/web_errors You also create, delete and otherwise manipulate saved searches without having to interact with the UI. It's also possible just disable the alert action. ... View more

Yep, although the parentheses are necessary...just needed the data. Thanks! ... View more