About phantom_mhike

phantom_mhike · ‎07-22-2022

@djacquens I just released the app "Fuse Box" on splunkbase for just this purpose. https://github.com/splunk-soar-connectors/fuseboxutility/blob/next/README.md It should be available in the new apps UI if interested in giving it a try.

phantom_mhike · ‎06-10-2022

There isn't a simple way to do this that I know of. Local is treated differently and the literal repo name "local" seems to be tied directly to both the default and handling the repository as local only. You can remove the local repository with some database shenanigans on the scm table. that will remove the default entry and require you to select the repo to store the content in. If you add a remote repo after that with the name local, that repository will then be the default but because it is the "local" named repo, the platform will not execute commands to sync updates made to that repo to the remote repository. You can ssh into the system and run the push commands yourself but that would be a fairly tedious process. I think your best option if you really just didnt want the local default would be to remove the local repo and manually select the correct repo every time, but that isn't going to gain you much other than preventing accidental commits to local.

phantom_mhike · ‎06-10-2022

If decisions don't quite have the level of flexibility you need, you can create a validator utility that does what you propose. Run your action. pass the output to the validator, use a decision to check to see that the validator output "success", and then you can proceed to use the output from the action as needed. Its a little inconvenient to have plug a utility into the process but you will find several generic check scenarios that are challenging to implement with the logical capabilities in today's decisions. There are several ideas posted for how decision customizability could be improved but there are no guarantees on implementation or timeline for those yet.

phantom_mhike · ‎05-27-2022

I know this is old, but I solved this with a custom app to short circuit a playbook. The app checks a list to see if the identifiers for the current event have already been seen. If it is already in the list then it outputs a True and the playbook can be halted and handled as a duplicate. If it hasnt been seen before, the app outputs false and the playbook can proceed as the first instance of this event ingested. This all works because apps do have locks. If the app is set to lock and only have one concurrent run, then adding this check as the first step in the playbook will break the race condition you are dealing with. The only significant downside is that this will effectively turn your ingest pipeline into a serial stream which can be problematic for especially high volumes of events.

phantom_mhike · ‎05-27-2022

There is a lot of context here for some app operations like widget generation but its not terribly useful beyond the scope of debugging an app issue. I would suggest adding it to the logrotate conf and setting it to roll daily. I wouldn't personally keep more than 7 days. Really if you are debugging an app, historical records are much less useful that active debugging.

phantom_mhike · ‎05-27-2022

@ktsplunksoar, @phanTom 100 percent correct on this whether we are talking about supported or unsupported options. I have tried every version I can think of for hacking together a short circuit in prompts with a default or an auto fill. Without a feature addition, there is no way to do this.

phantom_mhike · ‎08-06-2021

I have seen this happen a couple of ways. The most frequent but unobvious one is that your login session has expired but the playbook editor was still open. If that is not the case, then I would check on phantoms running processes and make sure decided is running along with the rest of the phantom services. Worst case scenario, try restarting the phantom platform by running /opt/phantom/stop_phantom.sh followed by /opt/phantom/bin/start_phantom.sh

phantom_mhike · ‎04-07-2021

You might modify the title with [Solution] or add the answer and select your own answer as the solution. Just so that anyone else having the issue knows that this is an answer and not just someone else asking for help with the same problem.

phantom_mhike · ‎04-07-2021

Multiple people have reported this in the Phantom community slack. If you haven't already, definitely submit a support ticket and add an entry at ideas.splunk.com with your support ticket number attached.

phantom_mhike · ‎04-07-2021

"Easier depends on experience in each platform and available resources. If you have phantom and you are already using it for other automation, then yes, it is likely to be simpler. I wouldn't recommend setting up a phantom instance for this single case. And if your experience in phantom is limited, it may be much faster to go the splunk app route. Phantom introduces more moving parts to your process so adding phantom for adding a user to an AD group doesn't make sense but using phantom that is already operational and part of your porcess anyway could very much make the job easier.

phantom_mhike · ‎05-20-2020

I highly recommend naming your playbooks concisely based on what they are intended to do at a high level. The primary reason that I suggest this is that within the mission control view, you have a limited width for displaying the playbooks execution history. If you prepend playbook names with a lot of metadata you end up only seeing a truncated version of the playbook name in the activity pane and that truncated detail ends up giving you no context for what the playbook actually did. I highly suggest using the name of the playbook as simply a high level description of what the playbook does ie "Infected Workstation Remediation". You can use the description field in the playbook to add a detailed description of how it accomplishes that. Tags are very effectively used to demonstrate teams that are using it as well as object types that are used in it. As of 4.5 (I think) your playbook listing provides you apps , actions, assets, and playbooks used so you don't need to specify that content in the name. Attempting to keep this kind of data in a playbook name can be exceedingly problematic since this metadata will change over time and you will have to update playbook names which in turn requires wiki documentation to be updated, and phantom calls to sub-playbooks to be updated, etc. The fewer changes you have to make to top level playbook names over time, the less trouble it will cause you.

phantom_mhike · ‎05-01-2020

Im not completely certain I follow the question. It seems you executed a prompt2 within the context of a custom function? If that is the case, you can still access the data you need as long as you specified a name and a callback for the prompt2. If you didnt specify a name then you will have a hard time manually specifying the action results. If you dont define a callback then the playbook wont wait for the prompt to be addressed and your results will always be null. The VPE doesnt know to look for the action results from custom functions like that so you will have to specify them manually:

phantom_mhike · ‎05-01-2020

No. I have never been in a situation where I wanted to drop the default app library.

phantom_mhike · ‎05-01-2020

If these are custom apps that you have written, i have tackled automated deployment is kind of a sketchy way but it will work. Log onto the phantom server via ssh and clone your app repository to the file system where ever you want it stored Write a script that does the following: • Pull the latest from the repo • Pull the current app versions from the phantom API • Check the current app version for each app in the repo • If the repo version is different, run phantoms compile script with -i to install it to the server Cron that script to your desired frequency or create a playbook that you can run adhoc that will run the script. I prefer cron because then you dont have to tangle with the permissions for the phantom-worker to run the script and execute all the required commands. Its a little clunky but it gets you out of the business of creating and manually uploading custom app tgz files.

phantom_mhike · ‎05-01-2020

There are ways that you can accomplish this in a playbook but none of them are strategically sound options if you want to maintain a stable and consistent phantom environment. In general, looping playbooks is one of the easiest ways to make sure that your phantom host stops processing any other automation which is not what you are going for here. I am listing three good options here in order of level of effort. I recommend suggestion 1 but any of them will work. 1 ) You could write a python script that uses the rest api to check for containers that have owners set but have not run your playbook yet and execute the playbook from there. You can schedule that cron job fairly frequently without having any serious impact on performance. 2 ) Another option would be to create a playbook that essentially does the same thing as the cron script described and use a timer asset and label to execute that playbook. you will take a larger performance hit running it this way especially if you have a lot of automation going. But this does allow you to keep your automation in the UI and not hiding in a cron script. 3 ) A better option than the timer would be to write a simple custom phantom app and use the on_poll function to execute the operation described in the cron script above.

phantom_mhike · ‎04-30-2020

Within the context of a playbook you can use this to get the user that executed the playbook. This is only effective if a user manually executed the playbook, otherwise it will just return the id of the automation user. user_id = phantom.get_effective_user() Hopefully that answers your question. Outside of the context of playbook execution, the premise of "the current logged in user" doesn't make any sense. Any number of users could be logged in at any given time.

phantom_mhike · ‎04-20-2020

I did not dig extensively into the issue you are seeing because that app code is 4 years old. The app version you can get from my.phantom.us right now is far more recent. I would also suggest following the advice in the release notes about deleting old assets and rebuilding them. PassiveTotal Release Notes - Published by Phantom February 05, 2019 Version 1.2.36 - Released February 05, 2019 Compatibility changes for Phantom release 4.2 Version 1.2.28 - Released February 06, 2018 App action views and Logo updates Version 1.2.25 - Released August 23, 2017 3.0 compatibility update release only Version 1.2.23 - Released July 27, 2017 3.0 compatibility update release only Version 1.2.22 - Released March 23, 2017 Minor error handling fix Version 1.2.21 - Released December 12, 2016 NOTE: Existing PassiveTotal Assets must be deleted, and a new one must be created after installing this version. The app has been rewritten to use the new PassiveTotal APIv2, their v1 API has been deprecated Added "whois ip" and "whois domain" actions Removed verify server certificate option, we now always validate the certificate

phantom_mhike · ‎04-18-2020

Can you provide the name of the app you are trying to set up? Its pretty hard to check out the problem without being able to look at the app itself.

phantom_mhike · ‎01-27-2020

There are a couple issues that can cause this but if your issues is repeatable, I would suggest opening a support ticket and submitting logs every time a hang like this happens. I have gone through this a couple of times now and tracking down the problems that can cause this can be challenging. There are a few fixes coming up in the next version that may resolve your problem but dont bank on that. Get a support ticket going. BEFORE you restart: • Collect all the logs from /var/log/phantom and /var/log/nginx • Save the json from https:///rest/playbook_run?_filter_status="running" • Save the json from https:///rest/action_run?_filter_status="running" Once these are collected, you can restart and submit these files to a support ticket Keep in mind that when phantom is restarted, all queued containers that have not been run yet and those that are currently actively running will be canceled and will not be re-queued when phantom comes back online. Its a good idea to get a script up and running to re-run all of those "lost" containers.

phantom_mhike · ‎01-14-2020

Send a DM on the splunk slack to gsamuelhays with the email you registered with and what is going on. He can get you set up.

phantom_mhike · ‎12-22-2019

Send a DM on the splunk slack to gsamuelhays with the email you registered with and what is going on. He can get you set up.

phantom_mhike · ‎12-19-2019

I can't say that I have tackled this specific scenario before but my first approach in general would be to use the splunk 'run query' action and use the details available to identify the notable and then pull the ID from the results.

phantom_mhike · ‎12-16-2019

Were you able to resolve this? Was my answer helpful or was it an unrelated issue? If unrelated, please post about it here.

phantom_mhike · ‎12-16-2019

You could follow the advice I posted in your previous question and use slack or some other application to generate the sound alerts you are looking for.

phantom_mhike · ‎12-11-2019

I assume you are asking to have the web UI play a customized sound when a particular playbook runs. The rest of this response is based on that premise. You can't have the web interface play a custom sound when a playbook executes because the web interface has no awareness of playbooks that are running. There is no reason for it to be aware since it is not responsible for the execution. It only shows you the details that you need to see as context for the view you have open. The only significant callback that the web interface provides out of context is the alerts for prompts and actions since those are directed at individual users and roles. To accomplish more or less the same goal, you could potentially add a slack notification at the end of your playbook. If you give that slack bot a unique notification sound in your workspace, you will have a customized tone for every time that notification comes in. I'm not sure what the end goal here is. If you are trying to notify a user that there is a new container for them to look at, then owner assignment will accomplish the same thing with the web interface alerts. If you are trying to alert the masses to an escalated situation, I recommend a more robust response than generating a sound. If it is just for general awareness that the playbook ran successfully, then I generally recommend building monitoring around playbook failures instead. As usage of phantom grows, playbook successes become a constant norm, but errors and failures require attention.

Posts	37
Solutions	10
Karma Given	11
Karma Received	20
Member Since	‎10-24-2019

Online Status	Offline
Date Last Visited	‎03-28-2024 04:02 PM

Re: Lock for Playbooks

Re: How to Save an external repository as the defa...

Re: Validating data of an action inside a decision...

Re: Does a Lock for Playbooks function exist?

Re: What is the best practice to rotate the /var/l...

Re: Phantom Prompt Block - being able to set defau...

Re: Getting failed to communicate with platform co...

Re: Cofense Triage Add-On account credentials

Re: Phantom Time Change

Re: Add a User to an AD group using Phantom

Re: Recommendations for naming conventions and org...

Re: call API to get results from prompt?

Re: Unable to configure additional Phantom App rep...

Re: Unable to configure additional Phantom App rep...

Re: How to create loop in Phantom playbook to chec...

Re: How do I get a phantom user object from the AP...

Re: Configuring App - Error - Missing required fie...

Re: Configuring App - Error - Missing required fie...

Re: Phantom environment is not stable occasionally...

Re: Splunk Phantom Community Edition Approval Pend...

Re: Splunk Phantom Community Edition

Re: ES -> Adaptive Response -> Phantom Playbook ->...

Re: Not able to start Phantom

Re: Phantom Custom Code Alarm

Re: Customizable Sound of Phantom