@Nraj87 you can send to SOAR from ES using the Adaptive Response: https://help.splunk.com/en/splunk-soar/splunk-app-for-soar-export/4.3.25/send-data-between-the-splunk-platform-and-splunk-soar/run-adaptive-response-actions-in-splunk-es-to-send-notable-events-to-splunk-soar  Or you can use the Splunk app on SOAR to poll the notable index and it will create SOAR cases for each one ingested.    -- Hope this helps! If so please mark with Karma, or mark as a Solution if this resolved your issue. Happy SOARing! -- ... View more

Hey @SOAR_098 , Have you checked out the community Custom Functions, specifically the zip_extract one? https://github.com/phantomcyber/playbooks/blob/7.1/custom_functions/zip_extract.py  Seems like it should do what you need! As for converting to text, it depends on the file type it spits out and you may need to build a custom function to read, then write it out to txt file then add to the vault.  -- If this helped please add some Karma. If it resolved your issue please mark as a solution for others to see. Happy SOARing!! -- ... View more

@loz there is no need to create a default parser for this as the CEF parser exists. You simply need to redirect the data using the splunk_metadata.csv file as per the example here:  https://splunk.github.io/splunk-connect-for-syslog/main/sources/base/cef/#splunk-metadata-with-cef-events  ... View more

@annielee have you tried using the relevant .whl file for the 2 libs and adding to the app as a wheel dependency?  --- Hope this helped? Happy SOARing! --- ... View more

@mpc7zh  OpenSSL 1.0.2zj-fips 30 Jan 2024 ... View more

@hiepdao whilst on-prem it should be fine but you may need to check if the lib ever needs an update.  The best practise, especially if you ever move to Cloud SOAR, would be to create an app for the actions requiring pandas and then package the pandas .whl file as a dependency to make it more portable.  ... View more

@souha  Splunk SOAR (On-premises) supports these operating systems and versions: Red Hat Enterprise Linux 7.6 through 7.9 Red Hat Enterprise Linux 8.0 and any of the minor versions of 8. You can use the most recent minor release of RHEL 8 that is available at the time of the Splunk SOAR (On-premises) release. Amazon Linux 2 Oracle Linux 8 If you are unable to use any of these then you should raise a support case to see if they can help.  I think you could edit the install script to allow for another *nix OS but then you would be out of any support entitlement.  ... View more

@marnall I think the cleanest way, until they fix it, would be to build a Custom Function that uses REST to check the for the <thing> you want and then output a boolean to then use downstream.  At least the CF could be made re-usable for similar use cases.    ... View more

@mrilvan there is only a Splunk app for that at the moment and nothing on the SOAR Side. However if the API is available there is nothing stopping you building a custom app in the platform as I am sure XSOAR is just another REST API.   ... View more

@sayala Firstly, I would say this is a "not best practise" use of tags for the reasons you are coming up against now.  Surely something like a custom field would be better as you can both populate and use in anyway you want and it comes into Splunk too with the container data if you are using the tags for trending etc? I can't see a REST endpoint for tag management at a system level as this would be your best option to do it at any scale.  Unfortunately, for now and without a lot of potential digging, you will need to delete manually.  I would advise you to think of a different way though otherwise you will face a buggy UI going forward.  Hope this helped!? Happy SOARing ... View more

@T_K_421 Based on what you are seeing the likely issues are either Network or Permissions on the Azure side.  If you followed the instructions then it should work. It may be worth either re-validating the existing config or starting again.  ... View more

@Iñigo you can already make dynamic list options in the prompts but you need to use custom code and bear in mind it "breaks" the VPE control of the prompt block. You can use any of the API options to grab the dynamic fields you want to use then you just need to build the  choices variable in response_types and the prompt will show them. The issue you will have though is then how to handle the response if they are truly dynamic. i.e how would you know what they could choose to then handle the response. It can be done but needs to also be considered.  # responses response_types = [ { "prompt": "", "options": { "type": "list", "choices": [ "a", "b" ], }, } ] ... View more

@N_K  You can make an action block loop through a list of parameters with the right input from a format block. With the HTTP app it may be harder to do as there are a lot of potential parameters.  Yeah, please don't try to use requests outside of an app space 😄  Depending what you are using the HTTP app for it may be best to build an app to handle it as you get a lot more control over the behaviour and the HTTP app, IMO, is usually only useful to test interactions with external APIs OR simple HTTP related tasks.  How many parameters are dynamic when using the HTTP app?  ... View more

@N_K I would recommend that you make the input playbook capable of handling list items as inputs and doing the iteration inside the playbook as it will be the path of least resistance and put less strain on the platform from a worker perspective.  ... View more

@johnlee2327  Firstly I would not recommend you use this in email as you will need to embed the username & password in to the link you give.  External prompts are coming in the next release AFAIK so you may not want to expend a lot of energy on this to then have it natively available.  For your question I thin you just need to put "deny" as a string not a list object.    -- Hope this helps. Happy SOARing -- ... View more

@catherinelam "warm standby" is the architecture and Primary / Secondary is the server role. One is only active at any one time.  ... View more

@meshorer  The IN operator will only look for the entire entry in the list so won't work as you cant wildcard the entries. You may have to pull in containers within a date/time range and then do some post-processing in custom code to grab what you need from the returned values.  ... View more

@ivan5593  This is certainly possible using an authentication account which will give you a token to interact with the SOAR API.  The you just need to use the correct API endpoint with the correct payload to send events to SOAR: https://docs.splunk.com/Documentation/SOARonprem/5.3.1/PlatformAPI/Using  If you want to initiate a playbook from JIRA than you need the playbook_run API endpoint with the correct payload.  I would also say that the JIRA app has an On Poll action that you can setup with some JQL to only pull in what you want and it will just create containers for you whenever it polls and finds something new. This would be better if you had playbooks that ran on ingestion into SOAR.  -- Hope this helps! If so please mark as a solution for future. Happy SOARing!  -- ... View more

@harishlnu  For the forwarding part: https://docs.splunk.com/Documentation/SOARonprem/6.2.1/Admin/Forwarders  The other element is just using SPL to look for things in the logs sent from SOAR to Splunk. The Splunk app for SOAR will have docs on what sourcetypes it sends through that would include ingestd.log.  You should have enough information now to do some research and start to develop what you need.  -- Happy SOARing -- ... View more

@harishlnu  If a Correlation Search is configured to send to SOAR then you just need the _internal logs for the modaction send_to_phantom to be checked for failures in sending then also use the ingestd.log to look for failures to ingest on the SOAR side. The ingestd.log should be one of the DAEMON logs you can forward from SOAR to Splunk.  ... View more