I've noticed that it's possible to run a playbook in scope of one single artifact using Playbook Debuger. Is there any way to make playbooks behave like this in normal usage also? To better describe what I mean let me use simplified example - let's say that I have a playbook that gathers names of the artifacts via 'format' block. Later on, text from this format block is used as a query in another block. So if there are 3 artifacts in this container, output from format block looks like this: "name1, name2, name3". And what I want to do is to get the first name, pass it to the next blocks until the whole process is finished and then come back to the start of this playbook, get the second name and so on. My playbook is working properly for single artifacts, but it fails while running on whole events, as my queries are not working with multiple arguments being passed. Is there any workaround for this? *UPDATE* According to Customize the format of your Splunk Phantom playbook content - Splunk Documentation I tried the option to include '%%' to the format block, but it did not change much. Still the next block is using whole format block output at once. ... View more

I'm trying to add attributes via Phantom MISP app. Adding attributes itself works fine for me when I'm just using predefined fields for specific values like 'email-dst', but I need to include also 'comment' for the attributes I'm adding. So I decided to use 'json' field of the GUI configuration, which should allow me to pass custom built attributes. And here the first issues appeared. App documentation does not give an example how mentioned json string should look like when adding custom attributes. Initially I was basing on Automation and MISP API · User guide of MISP Malware Information Sharing Platform, a Threat Sharing Platform. (circl.lu), where json string was like this:  {"event_id":"3542","value":"1.2.3.4","category":"Network activity","type":"ip-dst"} But unfortunately this one was not working - no attribute was added. Via trial and error method I was able to discover that I can add attributes of defined type with following json, which is extremely different than the one mentioned in MISP API documentation: {"email-dst":"test@email.com,"}. And please note that this comma at the end is not a typo - without it, no attribute is added. I have no idea why it's working this way, but it allows me to add an attribute to an event. However this is where I got stuck. I have no idea how to include comment field for such attribute. I've tried several combinations containing {"comment":"abc"} but then I receive 3 attributes of 'comment' type with values - 'a', 'b', 'c'. Does maybe someone know how to add attributes with comment using Phantom MISP app? ... View more

I am trying to search for MISP events by their name, which is present in 'info' field. For this purpose I'm using 'other' and putting following json: {"info":"text to search for"}. Query does not give any error, but results are not really related to the text I specified. I'm just receiving first 10 events present in the MISP, even if I specify whole title in the query, not only the keyword. Am I doing something wrong? I've also tried approach with using format block and double braces, as mentioned here: Solved: Phantom MISP "Run Query" action - Splunk Community but no difference. Is there any way to search for events by keywords in the 'info' field? ... View more