@harishlnu one way I have done this in the past is to use 2 lots of automation.  1st automation sends the email with a key nested in the HTML such as "SOARKEY=" and then add useful information to the other side, usually b64 encoded, at a minimum having the original container id in it. This sends the email and then stops automation.  Then you ingest the replies (you may need to setup mail rules to push replies to SOAR emails into a dedicated inbox) using SOAR and look for the SOARKEY in the HTML Body, get the encoded string, decode and then <do something>.   -- Hope this helps! Happy SOARing! --  ... View more

@SOARt_of_Lost the only way I can think of initially is to have a scheduled playbook to check for containers from notables without artifacts and then run the relevant playbook against them. Timer app would be used to create the container to kick the utility playbook off as regularly as you want.  ... View more

@meshorer there isn't anything inbuilt, but there is a Custom Function in the community Repo called "find_related_containers" which should get you somewhere close to what you want. TBH I would recommend building your own but it can be complicated depending on how you want to define "relevant" containers.  As for the playbook logs, I am not sure where they are on-disk. I can't see anything in $PHANTOM_HOME/var/log/phantom but suspect they are somewhere on the system.  ... View more

@stevenbo I am curious why you need to do this tbh.  You may also find that your current setup will be unsupported after your changes. Always best to get some top cover from Splunk Support, especially if it's going to be a production system.  ... View more

@meshorer  You will need to monitor the ingestd.log on the platform to check for any ingestion failures. It's best to get this into Splunk and it depends on the version you have as to how it gets there.  In the latest version there is a UF on the box that you can configure in "Forwarder Settings" and this can send all of the SOAR Logs into the splunk_app_soar index: index=splunk_app_soar source=*ingestd.log  You should be able to make some detections there.  In the older versions most data is sent via HEC but DOESN'T include these logs so you will need to put a UF on the server yourself and then load in the splunk_app_for_soar to it and that should grab the Daemon logs and send to splunk in the same way as above. -- Did this fix the issue? If so please mark as a solution. Happy SOARing! -- ... View more

Gotcha and no worries, that's what I am here for 😁 If you have an LB that can do some kind of probing for the active box then it shouldn't matter if DNS has an issue as the LB will decide which is "healthy" and the DNS record just points to the LB if that makes sense? Not done it myself but definitely heard it a few times in the Warm/Standby conversations around automating the failover.  ... View more

@catherinelam I highly doubt it although it's probably somewhere on the system.  My 1st question would have to be why? No-one should be going to the standby as it should be behind some DNS and/or LB that only sends traffic to the "active" box.  If in doubt I would ask support as changing this, if possible, may cause issues with the support agreement.  ... View more

@marq198 you know the Splunk app has an "update_notable" action? You say you don't know what the header or body should look like? I would ask shy you're trying this without that information, it's kind of important 😁. See if you can use the Splunk app otherwise I would recommend reading up on how to interact with the Splunk API and then you should be able to make it work: https://docs.splunk.com/Documentation/Splunk/9.2.0/RESTTUT/RESTTutorialIntro  ... View more

@cmg I do have to ask why you are doing it this way? The app framework removes all of this necessity 😄    As my old mentor said "Use the platform Luke...erm Tom" 😄  Why not just use the HTTP action and then select the data returned by using the relevant datapath downstream. The HTTP app doesn't show you all the returned fields in the playbook datapaths as the dev couldn't know all returned so stopped at "response_body" or "parsed_response_body". You have to write the path to the returned data yourself.   Best way is to run the action, select it in the activity pane of the container, find the value you want in the JSON presented and click on the key in the window. There should be a datapath -type thing at the top. 0 = * and > = . in the datapath you put in the playbook.  -- Hope this helped! If it solved your issue please mark as a solution for future questions on the same thing. Happy SOARing! -- ... View more

@meshorer just add more keys & values to the JSON string 😁 {{"new_field1": "{0}", "new_field2": "{1}"}}     ... View more

@ansusabu_25 the app is not ES specific but can be installed on any SH. You should have the option already shown to you and this will stop the multiple artifacts being created. At the moment, multiple artifacts are created due to there being 1 or more MV fields in the results data. If you set the setting already shown then you will get 1 event with 1 artifact in but the values for some of the fields will be lists which you will need to handle in playbooks, as in configure any blocks to be able to process single and list items. Previously I have used a playbook on ingest to split the MV fields into artifacts without all the additional duplication.  Hope this helps! Happy SOARing!!  ... View more

@AL3Z  To get Notable events from ES into SOAR you need the Splunk App for SOAR Export  setup on your Search Head then you will need to add the Adaptive Response to send to SOAR when the detection triggers an event in Splunk.  ... View more

Again I am sorry but that is not clear.  You can use Splunk SOAR to run SPL in Splunk/ES using the Splunk App's run_query action. You will have to either know the full SPL and run manually, or if they are standard, regularly used searches you can build playbooks to dynamically populate the SPL before running it in Splunk.  If you want to find all the events that came from ES then that would usually be to check how many containers/events have that specific label which can be done via REST: https://<soar_url>/rest/container?_filter_label=<your_label> This should return a count of all containers/events with that label. ... View more

@AL3Z Correlation Searches reside in Enterprise Security. To get them into SOAR you need to use the SOAR Adaptive responses (send_to_phantom/run_playbook) on the Notable Event which will create a container/event in SOAR for you to run automation against.  If I misunderstood the ask please expand and I will try to help.  ... View more

Just checking that the correlation searches are the same across the env and they all have the "Create Notable" and "Create Mission Control Incident" Adaptive responses? ... View more

Same OS? SeLinux turned on or some other company agent on there?? These are the usual culprits for this kind of fun errors 😄  ... View more

@catherinelam I have not seen this before but it does look Postgres-ey.  Is this a single instance or Hot/Warm standby? If so are you sure the postgres stream is allowed (5432) between them and you have confirmed the sync is working? The files are definitely Postgres files but I am not sure what action creates them and why they would be deleted during runtime to then "go missing".  I hope you have also raised a support case for this too?   ... View more

@MikeR a few ways to achieve this, but simplest is probably to use the Phantom Phantom app with the 'add_artifact' action. This will use phantom.collect() and if you set the container input to the id of the other container it will update it with the provided artifact info provided in the action and should  return an id.  ... View more

@emesabarrameda I can't seem to find anything in the docs: https://docs.splunk.com/Documentation/SOARonprem/6.2.0/DevelopApps/AppDevAPIRef  Both options you call out have the tag option which could maybe be used for thee INFO/WARNING/TRACE strings? Any reason you want to Split into those categories as it all ends up in spawn.log anyway.  ... View more

@Carloszavala121 as @jenniandthebets said, the best way is to create your own app for this or modify the existing one to remove the need for base_url at the asset level and have it as a parameter for the GET action instead maybe. ... View more

@meshorer <tag name> is in container:tags should work. The tag name is case sensitive and has to be exact match.  ... View more