@shanto12 you should just be able to tar it up and install via the UI in the apps location? AFAIK py2 is still supported on 5.1.x on-prem.  ... View more

@djacquens if you are using the python sleep then I would highly recommend you undo asap as it will cause platform instability and halt automation for the duration of the sleep. If using something else then please ignore the above 😄  First, I would need to understand why playbooks are running on the same container more than once.  An immediate fix is to add a tag to the container when the playbook first runs, then have a decision at the front that checks if the tag exists and will just end if it does.  If you are adding artifacts to the container during automation and DON'T want the pb to run again make sure you are setting the 'run_automation' flag to false when creating the artifacts.  Hope this helps.  ... View more

@CS_ yeah I realised the playbook input/output wouldn't work when I re-read your original question 😄  As for using REST in a playbook there are 2 ways: 1. HTTP app to query REST and then use the response_body downstream 2. Custom Function using the phantom.requests() capability.  An example piece of code to get some data from the action_run endpoint would look something like: url = phantom.build_phantom_rest_url('action_run') params = [('_filter_container', '"<id>"'(, ('_filter_name', '"<action_name>"'), ('page_size', 0)] r = phantom.requests.get(url, params=params, verify=False) try:     response = json.loads(r.text) except Exception as e:     phantom.debug(f"Something went wrong: {e}") Then <do something with the response data such as grab the ID>: action_id = response['data'][0].get('id')  ^^ was written from memory so "should" work but may need tweaking 😄  ... View more

@CS_  great job finding this but may I ask what version of SOAR you are using? If 5.x then you can simply pass the value as an output on one playbook and then retrieve or pass that value through to other playbooks/functions to do what you need.  Also have you considered just using REST to get the action_run details when you need them rather than having to persist some data? Example: /rest/action_run?_filter_container="<id>"&_filter_name="<action_name>" This will return the ID along with other information about the run. https://docs.splunk.com/Documentation/SOARonprem/5.2.1/PlatformAPI/RESTRunAction  https://docs.splunk.com/Documentation/SOARonprem/5.2.1/PlatformAPI/RESTQueryData  https://docs.splunk.com/Documentation/SOARonprem/5.2.1/PlaybookAPI/SessionAPI  With the above you could build a custom function to do this for you without having to write the save_object & get_object calls in each playbook you need this capability in.  ... View more

@mrzn I would remove the 4 days wait and try to handle this in a different way as this is far from best-practise. Each playbook with a prompt waiting for response will be keeping a daemon resource active the whole time and is excessive, IMHO. It also isn't robust as if the server or daemon was ever restarted you would lose all existing prompts!! Depending on the use case I think you would be better to send an email with an encoded string that gets added to the HTML body, this usually contains the container_id the email was sent from and any other useful information to inform the automation upon reply and decryption. You then ingest the emails from the inbox where replies go to, have a playbook that grabs the encrypted key, decrypts and then takes the relevant action on the event. This way you are not keeping playbook(s) in a waiting state for up to 4 days.  There will likely be many ways to approach this, the above is something I have done a lot to get around the possible days' waiting for replies. Prompt timeouts should, again IMO, be no longer than an hour.  Happy to discuss further if you need ! ... View more

@jeffrey_berry I think I am struggling because although I think it adds great context in a SIEM where you are looking for time-based information, Splunk SOAR is a Security Automation Platform & I am failing to see the value add for automating security response.  Now I am not a daily administrator of the platform so appreciate your experience is completely different to mine!  If you are externalising your SOAR platform's data to an Externally Managed Splunk Enterprise instance then that is the best practise and best place to create the rich dashboards and that has always been my recommendation over the years. I am also only one person so don't let me stop you raising an idea! If you think it's valid then someone else might and you can always try to get some support from the community!  Happy Phantoming SOARing ... View more

@jeffrey_berry I understand the ask but Splunk doesn't do this so not sure the benefit. Surely if you put 1y and only have 9months of data it will only show 9months and I wouldn't call that misleading as such? However if you feel it worthy please add an idea to https://ideas.splunk.com/ and get people to up-vote it. This has been very successful in getting some great features into the platform! E.G. I asked for the scope toggle on action blocks and it only took a few months to make it to the platform!  ... View more

@CS_  it may be similar in that the database entry/entries may only be masked from the UI but you would need to go digging through postgres database to find all the relevant entries, if they still exist! This is why the ability to delete is not allowed on any out of the box account (except admin) as it is not simple to recover from a deletion. I would recommend a support call to verify this and for them to advise how, if at all, you might be able to retrieve the data.  If you externalise your data to Splunk you might be able to "stitch" the data back together but it wouldn't be simple.  ... View more

@zubairaizatron  I am not sure what is going on with your install without checking some of the logs around the postgres startup.  However, the instructions you are following are if you want to use any other account than the default. 5.x is unprivileged by default and now runs under the phantom user rather than the root user as it did previously.  I suspect you will have more luck simply installing the latest version on SOAR either via OVA or RPM.   As per the 1st paragraph on the OVA install: https://docs.splunk.com/Documentation/SOARonprem/5.0.1/Install/InstallOVA  "The virtual machine image of Splunk SOAR (On-premises) is for an unprivileged installation, meaning the the application runs under the phantom user account, not as the root user." If this is just for personal use then I would just go with the above. If it's for professional/licensed use then I would raise a support case under your customer entitlement.  ... View more

@mark_wymer I thought it was you 😀!! Yeah not bad thanks, still here 😉 Yes, you have it correct; write the file to the OS, add to the vault then use the vault_id to attach, or add to a list of vault_ids to attach. When you add to the vault it will be added to a separate location on the OS that is under vault control. I'm not 100% sure if the file deletes when you add to the vault, however, you can delete the file if you wish but if it's in a "true" tmp directory then it will get flushed on reboot but if there is a chance there will be a lot of this activity it might be best to put something in place to clear the tmp directory, outside of a reboot, more regularly? ... View more

@iamraprap not quite sure what you mean.  The power of SOAR is the automation and an analyst/human should only be brought in if necessary. Playbooks should all be written to check for the data it needs to perform its function and if that means filtering artifacts based on some data before performing an action, that it what Splunk SOAR is made for. IMO, all analyst actions should be controlled by a playbook for consistency, even for relatively simple click-able tasks in the UI as it gives a lot more control and visibility of the analyst's use of the Platform and makes things a lot more efficient/consistent.  Scope is something that once understood makes a lot of sense, and is configurable on individual blocks in playbooks since 4.10.7. Happy SOARing! ... View more

The REST call to run a playbook takes an optional argument of "scope" which accepts a list of integers of artifact_ids, this will be how the playbook is called by the platform, invisible to you or I. The list of artifact ids will be passed to the playbook as parameters. No code in the playbook will show you how this works as it's "under the hood".  https://docs.splunk.com/Documentation/SOARonprem/5.1.0/PlatformAPI/RESTRunPlaybook  As for accessing the fields, this is where datapaths come in and you need to use them to retrieve the values you want from the fields you want. It's worth using decision to check if the field exists, and a filter to filter just the value you want else you may get invalid results with Nones.  ... View more

@iamraprap welcome to the community! There is no datapath for what you are asking as a playbook is totally unaware of any boxes being ticked on a container. However, depending on how the artifacts are created, you may be able to use a combination of conditions in a decision/filter to only act upon the relevant artifact in a playbook.  As for running from the UI; if you select an artifact and press the >Playbook button, in the bottom-left of the new window you can select "artifact" which will mean the playbook will only run against the selected artifact(s). To run an action against an artifact is different as actions will only run against values, these are contained in the artifacts. If you click a value and see a drop-down appear, this will contain all of the actions available for the type of data SOAR thinks the value is and you can run individual actions manually that way too.  Hope this helped, if so please mark as the solution. Or if you need more info please let me know.  ... View more

@andrew_burnett is this the 1st thing it asks or are you seeing stuff happen 1st and then it asks for the account? E.G. Do you get to put cert info in, set pgbouncer password and subnet info and then it fails? Are you able to screenshot the point you get to and the error? I take it you are using: https://docs.splunk.com/Documentation/SOARonprem/5.1.0/Install/makeservernode  AFAIK 5.1 doesn't have a "user" account as it's unpriv by default now so have you tried the 'phantom' user password?  ... View more

@andrew_burnett the "user" account usually refers to the "root" account and is created upon initial install to allow SSH to a "root-like" account.  What version of SOAR are you running? I only built a cluster with 4.10.x and the user account has the same password as the 'root' account which was set at initial build. Newer versions of SOAR use the 'phantom' account for most of its capabilities so maybe the docs need updating? If you have a support entitlement it's definitely worth getting something raised to assist you and also make sure that any associated documentation is made correct and simpler to follow and understand.  Hope this helps.  ... View more

@Qingguo at the moment the only way to control this is to have a playbook with a prompt for the person inputting the time stamp, then you can validate the prompt entry with a little bit of custom code in the playbook. If valid, add to the custom_field else either ask again in the same playbook or fail and inform the user that they inputted an incorrect date and they should re-run the playbook.  I have done this at a few customers now.  ... View more

@dmw you just need to be able to hit the REST API of Phantom and there are 2 ways (within Phantom) to do this: 1. Use the HTTP app  2. Use the phantom.requests() capability and write the code out yourself in a playbook.  Some docs to help query REST REST: https://docs.splunk.com/Documentation/SOARonprem/5.1.0/PlatformAPI/RESTQueryData  phantom.requests() documentation: https://docs.splunk.com/Documentation/SOARonprem/5.1.0/PlaybookAPI/SessionAPI  ... View more

@dmw There is an undocumented** endpoint that shows all the mappings of cases to those attached to a case.  /rest/case_container_map You can query this and then look for any result with your case as the `case_container` key and each `source_container` is one that is merged, whether in evidence or not.  **as the Endpoint is undocumented it could change at any point  ... View more