I want to trigger a Splunk SOAR playbook to iterate through a list of hosts every hour and check if they are online in our EDR tool, and if they are online to display a message to the user via the EDR API. Although the playbook is already complete, I can't think of a good way to have it execute every hour. I thought about using a Splunk app ingestion to query our Splunk instance every 60 minutes to create a dummy label and container that the playbook could be set to "active" on, but that seems like an awkward work around.    Is there some other app or setting I'm missing that could achieve this goal?   ... View more

Recently upgraded to SOAR 5.0.1from Phantom 4.10 and I'm having some difficulty finding the old "API" actions that can do things like: Available APIs set label set sensitivity set severity set status set owner add list remove list pin add tag remove tag add comment add note promote to case In the new visual editor there is an option for adding "actions" but the API isn't listed in there. It only lists actions from my configured apps... How can we "set status" of a container in the new Visual Editor? ... View more