Hey @jjkel if you are debugging they may look similar but it's more about when you use the output datapath from the format block ending in .* (should an option in the selector) that the subsequent action block is aware the input is a list and will change the underlying python to iterate through each item in the list.  If you could post a picture of your format block and the path you are using in the downstream action we can validate if this should work. AFAIK it should still work this way.  ... View more

@jjkel I don't think another playbook is necessary here, would a format block using the list capability not work? e.g. %% {0} %% 0 = finding:consolidated_findings.example Then use the format block .* output in the next block and it should create a for loop to iterate through each value extracted from the list.    ... View more

@zoghiboy that last error indicates that some events are exactly the same, hence creating the same source identifier, and are not ingested into SOAR.  I think that's where you should look: Are any events exact duplications? I can't recall the specifics about what Splunk SOAR uses from the event sent to it to generate the source_data_identifier but this is heavy evidence towards that's why you are not seeing some.  I would also recommend raising a support ticket, if you haven't already, as they have likely seen this a lot.  -- Hope this helped, if so please either add Karma or Mark as a Solution for future SOARers. Happy SOARing! -- ... View more

@pruthviraj_k_m If you know the endpoint/base_url and have an API key then you should just create a HTTP asset using this information, then when you use the POST action you may have to provide a header then it should perform the action, then you can review the responses from the call in the container you use to test the playbook.  When you create the asset for the HTTP app you will need to provide it with Base URL and you can also add the API key which will be hidden and encrypted in the database, as all passwords/api keys put in the asset settings are.  --- Hope this helps. Please mark as a solution if this solved your issue. Happy SOARing! --- ... View more

@pruthviraj_k_m I don't think there is an API that you can use for the Splunk AI Assistant, at least from what I can see online.  Usually AI is interacted with via an MCP Server, which there is a Splunk app for.  The other option is to wait for an app to be developed as I highly suspect one will, but as for timelines I have no idea.  What would you be interacting with AI for in a playbook? Triage/Decisions/Summarisation/Other? ... View more

@Agent I am really not sure as this would be something your JIRA Admin should be able to properly find. I suspect it's in some kind of self/base url setting in JIRA itself. I am glad we managed to find the issue as it did  seem a strange one based on what I know about SOAR apps etc. Please mark this post or the previous one as a Solution so that others, if they get this same issue, can find the response quickly and fix it in good time. Thanks for asking the question as I am sure you aren't the last to come across this edge case.    --- Happy SOARing! --- ... View more

@Sidpet  The create ticket action on the SNOW app takes in a string. Is the input to the Format Block a list of items or just text/string? What format block datapath are you inputting into the description field for the SNOW action? Don't use the ".*" one as that will imply to the SNOW action input that it's a list. The one without the ".*" end will just dump a text blob built in the Format Block.  If you need further help if you can share a screenshot of your format block and the input for the SNOW create ticket action we can probably identify where to check next.  -- If this helped please add karma and if it solved it also mark as a solution for future SOAR knowledge hunters! Happy SOARing -- ... View more

@nongingerale  Where are the searches you are checking being initiated from? And what do you need to do with the result of the check? You can run searches using the Splunk app on SOAR and this will handle all of the checking of status, etc for searches initiated from SOAR.  If you just want to check the status of any search running in Splunk and then <do something> when its status changes to one you want to act upon, you could use a HTTP action with the loop setting on the action block configured within your requirements to keep checking the status of a search job.  -- Hope this helped? If so please add Karma and/or Mark as a Solution for others to see. Happy SOARing! -- ... View more

@Nraj87 you can send to SOAR from ES using the Adaptive Response: https://help.splunk.com/en/splunk-soar/splunk-app-for-soar-export/4.3.25/send-data-between-the-splunk-platform-and-splunk-soar/run-adaptive-response-actions-in-splunk-es-to-send-notable-events-to-splunk-soar  Or you can use the Splunk app on SOAR to poll the notable index and it will create SOAR cases for each one ingested.    -- Hope this helps! If so please mark with Karma, or mark as a Solution if this resolved your issue. Happy SOARing! -- ... View more

Hey @SOAR_098 , Have you checked out the community Custom Functions, specifically the zip_extract one? https://github.com/phantomcyber/playbooks/blob/7.1/custom_functions/zip_extract.py  Seems like it should do what you need! As for converting to text, it depends on the file type it spits out and you may need to build a custom function to read, then write it out to txt file then add to the vault.  -- If this helped please add some Karma. If it resolved your issue please mark as a solution for others to see. Happy SOARing!! -- ... View more

@loz there is no need to create a default parser for this as the CEF parser exists. You simply need to redirect the data using the splunk_metadata.csv file as per the example here:  https://splunk.github.io/splunk-connect-for-syslog/main/sources/base/cef/#splunk-metadata-with-cef-events  ... View more

@annielee have you tried using the relevant .whl file for the 2 libs and adding to the app as a wheel dependency?  --- Hope this helped? Happy SOARing! --- ... View more

@mpc7zh  OpenSSL 1.0.2zj-fips 30 Jan 2024 ... View more

@hiepdao whilst on-prem it should be fine but you may need to check if the lib ever needs an update.  The best practise, especially if you ever move to Cloud SOAR, would be to create an app for the actions requiring pandas and then package the pandas .whl file as a dependency to make it more portable.  ... View more

@souha  Splunk SOAR (On-premises) supports these operating systems and versions: Red Hat Enterprise Linux 7.6 through 7.9 Red Hat Enterprise Linux 8.0 and any of the minor versions of 8. You can use the most recent minor release of RHEL 8 that is available at the time of the Splunk SOAR (On-premises) release. Amazon Linux 2 Oracle Linux 8 If you are unable to use any of these then you should raise a support case to see if they can help.  I think you could edit the install script to allow for another *nix OS but then you would be out of any support entitlement.  ... View more

@marnall I think the cleanest way, until they fix it, would be to build a Custom Function that uses REST to check the for the <thing> you want and then output a boolean to then use downstream.  At least the CF could be made re-usable for similar use cases.    ... View more

@mrilvan there is only a Splunk app for that at the moment and nothing on the SOAR Side. However if the API is available there is nothing stopping you building a custom app in the platform as I am sure XSOAR is just another REST API.   ... View more

@sayala Firstly, I would say this is a "not best practise" use of tags for the reasons you are coming up against now.  Surely something like a custom field would be better as you can both populate and use in anyway you want and it comes into Splunk too with the container data if you are using the tags for trending etc? I can't see a REST endpoint for tag management at a system level as this would be your best option to do it at any scale.  Unfortunately, for now and without a lot of potential digging, you will need to delete manually.  I would advise you to think of a different way though otherwise you will face a buggy UI going forward.  Hope this helped!? Happy SOARing ... View more

@T_K_421 Based on what you are seeing the likely issues are either Network or Permissions on the Azure side.  If you followed the instructions then it should work. It may be worth either re-validating the existing config or starting again.  ... View more