About linuts

linuts · ‎10-07-2021

Hello, I'm having some issues with the addon I created. I developed the addon with a simple python script to query an API, if the result is ok I got a json object and then write it to splunk. if it fails it writes a json object with the failed response. I've tested the script locally in my computer and it works, I've tested it in the addon builder and it works. Even when there is an error it returns the failed response. I have set up several inputs with it's own API url, but somehow some hosts keep failing even if the host is up, looks to me like the script is stuck, when it fails it has a exception handling function so it catches errors. I was testing up/down process and noticed when the host is down it will never detect when the host comes back online. Does anyone knows why this is happening??

linuts · ‎09-08-2020

Hello, whenever I try to add a new artifact I got the following error phantom.act(): 'add_artifact_1' cannot be run on asset 'phantom helper'. The "add artifact" action requires the following parameters: source_data_identifier. The given parameters look like they were automatically generated by phantom.act() because an empty parameters list was passed to phantom.act(). The parameters list may have been empty because the preceding call to phantom.collect2() returned an empty list. Check your calling code in the action that generated this error I presume is the container identifier, but how could I reference it in the playbook?

linuts · ‎09-04-2020

I know it's a few months after you asked, I had the same issue first I found out you'll need a new artifact created, I still can't find how to do this automatically. I'm running an splunk query for URL and then adding them to the artifacts. then in the options you'll need to add source_data_identifier --> the name you want cef_name---> in my example i use artifact:*.cef.requestURL cef_value ---> Splunk_Query:action_result.data.*.url (this is where the result of the investigate action) And that's it. You can test it by run an manual action within the container and check if it works

Posts	3
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎09-04-2020

Online Status	Offline
Date Last Visited	‎10-07-2021 05:43 PM

add-on builder issue

Phantom Add Artifact Error - source_data_identifie...

add-on builder issue

Phantom Add Artifact Error - source_data_identifie...

Re: What values do I use in Phantom's "Add Artifac...