@Sidpet  The create ticket action on the SNOW app takes in a string. Is the input to the Format Block a list of items or just text/string? What format block datapath are you inputting into the description field for the SNOW action? Don't use the ".*" one as that will imply to the SNOW action input that it's a list. The one without the ".*" end will just dump a text blob built in the Format Block.  If you need further help if you can share a screenshot of your format block and the input for the SNOW create ticket action we can probably identify where to check next.  -- If this helped please add karma and if it solved it also mark as a solution for future SOAR knowledge hunters! Happy SOARing -- ... View more

@nongingerale  Where are the searches you are checking being initiated from? And what do you need to do with the result of the check? You can run searches using the Splunk app on SOAR and this will handle all of the checking of status, etc for searches initiated from SOAR.  If you just want to check the status of any search running in Splunk and then <do something> when its status changes to one you want to act upon, you could use a HTTP action with the loop setting on the action block configured within your requirements to keep checking the status of a search job.  -- Hope this helped? If so please add Karma and/or Mark as a Solution for others to see. Happy SOARing! -- ... View more

@Nraj87 you can send to SOAR from ES using the Adaptive Response: https://help.splunk.com/en/splunk-soar/splunk-app-for-soar-export/4.3.25/send-data-between-the-splunk-platform-and-splunk-soar/run-adaptive-response-actions-in-splunk-es-to-send-notable-events-to-splunk-soar  Or you can use the Splunk app on SOAR to poll the notable index and it will create SOAR cases for each one ingested.    -- Hope this helps! If so please mark with Karma, or mark as a Solution if this resolved your issue. Happy SOARing! -- ... View more

Hey @SOAR_098 , Have you checked out the community Custom Functions, specifically the zip_extract one? https://github.com/phantomcyber/playbooks/blob/7.1/custom_functions/zip_extract.py  Seems like it should do what you need! As for converting to text, it depends on the file type it spits out and you may need to build a custom function to read, then write it out to txt file then add to the vault.  -- If this helped please add some Karma. If it resolved your issue please mark as a solution for others to see. Happy SOARing!! -- ... View more

@loz there is no need to create a default parser for this as the CEF parser exists. You simply need to redirect the data using the splunk_metadata.csv file as per the example here:  https://splunk.github.io/splunk-connect-for-syslog/main/sources/base/cef/#splunk-metadata-with-cef-events  ... View more

@annielee have you tried using the relevant .whl file for the 2 libs and adding to the app as a wheel dependency?  --- Hope this helped? Happy SOARing! --- ... View more

@mpc7zh  OpenSSL 1.0.2zj-fips 30 Jan 2024 ... View more

@hiepdao whilst on-prem it should be fine but you may need to check if the lib ever needs an update.  The best practise, especially if you ever move to Cloud SOAR, would be to create an app for the actions requiring pandas and then package the pandas .whl file as a dependency to make it more portable.  ... View more

@souha  Splunk SOAR (On-premises) supports these operating systems and versions: Red Hat Enterprise Linux 7.6 through 7.9 Red Hat Enterprise Linux 8.0 and any of the minor versions of 8. You can use the most recent minor release of RHEL 8 that is available at the time of the Splunk SOAR (On-premises) release. Amazon Linux 2 Oracle Linux 8 If you are unable to use any of these then you should raise a support case to see if they can help.  I think you could edit the install script to allow for another *nix OS but then you would be out of any support entitlement.  ... View more

@marnall I think the cleanest way, until they fix it, would be to build a Custom Function that uses REST to check the for the <thing> you want and then output a boolean to then use downstream.  At least the CF could be made re-usable for similar use cases.    ... View more

@mrilvan there is only a Splunk app for that at the moment and nothing on the SOAR Side. However if the API is available there is nothing stopping you building a custom app in the platform as I am sure XSOAR is just another REST API.   ... View more

@sayala Firstly, I would say this is a "not best practise" use of tags for the reasons you are coming up against now.  Surely something like a custom field would be better as you can both populate and use in anyway you want and it comes into Splunk too with the container data if you are using the tags for trending etc? I can't see a REST endpoint for tag management at a system level as this would be your best option to do it at any scale.  Unfortunately, for now and without a lot of potential digging, you will need to delete manually.  I would advise you to think of a different way though otherwise you will face a buggy UI going forward.  Hope this helped!? Happy SOARing ... View more

@T_K_421 Based on what you are seeing the likely issues are either Network or Permissions on the Azure side.  If you followed the instructions then it should work. It may be worth either re-validating the existing config or starting again.  ... View more

@Iñigo you can already make dynamic list options in the prompts but you need to use custom code and bear in mind it "breaks" the VPE control of the prompt block. You can use any of the API options to grab the dynamic fields you want to use then you just need to build the  choices variable in response_types and the prompt will show them. The issue you will have though is then how to handle the response if they are truly dynamic. i.e how would you know what they could choose to then handle the response. It can be done but needs to also be considered.  # responses response_types = [ { "prompt": "", "options": { "type": "list", "choices": [ "a", "b" ], }, } ] ... View more

@N_K  You can make an action block loop through a list of parameters with the right input from a format block. With the HTTP app it may be harder to do as there are a lot of potential parameters.  Yeah, please don't try to use requests outside of an app space 😄  Depending what you are using the HTTP app for it may be best to build an app to handle it as you get a lot more control over the behaviour and the HTTP app, IMO, is usually only useful to test interactions with external APIs OR simple HTTP related tasks.  How many parameters are dynamic when using the HTTP app?  ... View more

@N_K I would recommend that you make the input playbook capable of handling list items as inputs and doing the iteration inside the playbook as it will be the path of least resistance and put less strain on the platform from a worker perspective.  ... View more

@johnlee2327  Firstly I would not recommend you use this in email as you will need to embed the username & password in to the link you give.  External prompts are coming in the next release AFAIK so you may not want to expend a lot of energy on this to then have it natively available.  For your question I thin you just need to put "deny" as a string not a list object.    -- Hope this helps. Happy SOARing -- ... View more

@catherinelam "warm standby" is the architecture and Primary / Secondary is the server role. One is only active at any one time.  ... View more

@meshorer  The IN operator will only look for the entire entry in the list so won't work as you cant wildcard the entries. You may have to pull in containers within a date/time range and then do some post-processing in custom code to grab what you need from the returned values.  ... View more

@ivan5593  This is certainly possible using an authentication account which will give you a token to interact with the SOAR API.  The you just need to use the correct API endpoint with the correct payload to send events to SOAR: https://docs.splunk.com/Documentation/SOARonprem/5.3.1/PlatformAPI/Using  If you want to initiate a playbook from JIRA than you need the playbook_run API endpoint with the correct payload.  I would also say that the JIRA app has an On Poll action that you can setup with some JQL to only pull in what you want and it will just create containers for you whenever it polls and finds something new. This would be better if you had playbooks that ran on ingestion into SOAR.  -- Hope this helps! If so please mark as a solution for future. Happy SOARing!  -- ... View more