Hey, For app related issues, you can try reporting it Phantom Support / or to the developer of the App. In the meantime, just revert to the working app version while the issue is being identified / fixed in the newer version.   ... View more

Hi Alex, Yes it is possible as indicated in the above post, you need to use rest calls. I have done this by creating a python script to(create containers / run playbooks etc...) Just curious why does it needs to be run this way? I'm just thinking that it might be more of a overhead to manually input details, including identifying which Phantom container where the playbook will run... Just my 2 cents, If you are 100% sure you want to run playbooks on specific scenarios, you can probably design this playbook to run against a specific label, and design it to automatically get details on a the container (e.g. destinationHostName) and automatically trigger an action against that (e.g. get triage / contain). That way, there's no need for manual intervention...   Cheers, Carl ... View more

Hey,   Do you have a "Send to Phantom" adaptive response action? If yes, you can use that to automatically send a ES Notable to Phantom (which will then create a Phantom Container).   In addition, you must set a specific label  in the ES Alert (e.g. malware, phishing, etc...) The label will be used as a trigger mechanism for a specific playbook to run.   Once you finish adding a label in the ES Notable alert, You must also add the label on the Splunk Phantom side (Under Administration > Events Settings > Label settings > (add your preferred label name in here) PS: Don't use spaces in the label name, instead, use underscore "_" (e.g. host_ips / network_ips) Once you have done this, open the Phantom Playbook you want to run, Edit it, and under Playbook Settings > Operates on > select the preferred label you want to run. Set "Active" to On so that when a new containers comes into phantom that matches the label you used, the Playbook will automatically be triggered. Save the playbook and trigger some alerts to test...   Hope this helps, Carl   ... View more

Hey, Looks like the "info field" is incorrect... Could you try using any of the 2 from the MISP API doco:   eventinfo: Filter on the event's info field. searchall: Search for a full or a substring (delimited by % for substrings) in the event info, event tags, attribute tags, attribute values or attribute comment fields. {{"eventinfo":"search info here"}} {{"searchall":"search keyword here"}}    if it fails, not sure if you need to include the return format: {{ "returnFormat": "json", "eventinfo": "test event name here" }} source: https://www.circl.lu/doc/misp/automation/#search ... View more

Hey, Unfortunately I don't have an MISP setup so I can't actually give it a try. But reading the documentation, it says that the controller is a required field which is for "attributes" / "events". The info field appears to be under the "Event" Can you try  testing the below? Create a format block for this:  (and use it as an input to the "other" field of the MISP query) Test 1 {{"info":"search keyword here"}} Test 2 {{"Event":{"info":"search keyword here"}} Try doing an exact search first of the info name (e.g. "Test of the day (2016-03-16) - botnet 120"), if that works, try doing a search using a portion of the name (e.g. "Test / botnet") and see if that works too.   Cheers, Carl ... View more