We have a playbook which is making calls to SOAR REST API artifacts endpoint. We are having to pass the auth token for the REST API call in the script as plain text which isn't ideal. Given we haven't configured a vault/vault like solution (CA,Vault etc.) ,  1)We set a SOAR global environment variable and stored the value as a secret but how do we call this in our script? Have tried looking at all possible attributes in the phantom library - Documentation is next to none for this - I also tried os.environ.get but custom variables are not going to be present in it. I am able to access value of variables like NO_PROXY and it returns the respective value. Any ideas around this will help. 2)I am also trying to get the base URL for constructing the REST call  Using build_phantom_rest_url or get_base_url is  returning the URL as local address 127.0.0.1 and not our specific URL. In short, trying to access the values in the image within our custom function and haven't found a solution Making a REST API call requires auth and that option is ruled out for getting the API token. Any inputs will help. Thanks in advance. ... View more

Working on a use case which entails finding All containers/artifacts that match certain field conditions. The idea is to run an API query against SOAR artifact end point to get all the artifacts and use the returned artifact fields in further fulfilling automation. A few questions in this respect 1)Does SOAR support API filtering like described in this article - https://medium.com/@lovely_peel_hamster_92/splunk-phantom-rest-api-filters-956a58854bfc Specifically the ability to access child objects in JSON. Documentation does not seem to mention anything about accessing child objects. https://docs.splunk.com/Documentation/Phantom/4.10.7/PlatformAPI/RESTQueryData 3)Also when filters are applied, we seem to lose the ability to restrict the output to a list of fields. It returns the entire JSON while the requirement is for specific fields. What we are actually trying to achieve -  Check for closed SNow INCs and close corresponding Splunk ES notables, and SOAR containers. We have broken down the approach into modules and have the component parts working but the aforementioned filtering is tripping us up - Solving the problem will help us complete the playbook. I also found this and we are attempting something very similar - https://community.splunk.com/t5/Splunk-SOAR/Playbook-run-on-bulk-events/m-p/667251. Again, the filtering is key to completing this. Also, open to suggestions on approach to achieve the above. Thanks! in advance.   ... View more