Hi I've seen many recent changes on SOAR 6.3 regarding prompts, but I still don't see a way to define the allowed choices list as a parameter while creating a prompt block from the GUI. Many times the options that are available to the user are dynamic, so hard-coding the choices list isn't practical for the user, is prone to get out of date and force playbook redeployments. The only way I see so far is by using code blocks or by adding custom code to the prompt blocks (and losing the GUI handling in the process). Is there any way I'm missing to get the question choices from a datapath or a custom list? ... View more

Hi We are being unable to use the PostgreSQL connector since updating to SOAR version 6, either with the last connector version or with previous the ones. This issue is happening both on cloud environments and on-prem environments (which where connecting ok to PostgreSQL while on Phantom 5.X versions). This is the error we are getting on-prem (the very same happens on cloud enviroments with automation broker).   Testing Connectivity App 'PostgreSQL' started successfully (id: 1723042384532) on asset: 'pgdb'(id: 433) Loaded action execution configuration db login error SCRAM authentication requires libpq version 10 or above Test Connectivity Failed. PostgresqlConnector::initialize() returned error. I already opened a suport ticket weeks ago but maybe some of you were able to solve it on your own. Any ideas about the root cause and possible solutions? Regards ... View more

Hi I'm running REST queries to retrieve containers that need to be reprocessed in function of the values of some of their artifacts values. My approach is querying the artifacts REST endpoint in this way: /rest/artifact/?page_size=3000&_filter_name="my artifact of interest"&_filter_update_time__gt="2023-01-01T00:00:00"&_filter_[othercriteria] The thing is these artifacts are quite heavy and in this particular case I only need their container ID field, so there is no point in retrieving all the other irrelevant fields data.  If I were querying a single known artifact I could use the object detail specification documented, at https://docs.splunk.com/Documentation/SOARonprem/5.5.0/PlatformAPI/RESTQueryData#Requesting_Object_Detail  I haven't seed any similar way do specify which fields shall be retrieved while querying for an object list. Is there any way to do this?   Also, Is there any way one can query artifacts whose associated container has some properties? Right now I'm doing a massive artifact query, a massive container query and matching the results in a playbook. That's something that would be trivial and much more lighter to do by SQL-querying the underlying posrtgresql database.   Hints about this would be much appreciated. ... View more

Hi all, We use email ingestion as an input for several processes, mainly for phishing analysis. So far we are ingesting from O365 through the EWS app but we are experiencing some issues so we want to migrate to ingestion through Graph API via the Graph app. The thing is that comparing the artifacts generated at ingestion time for the same emails between the EWS app and the Graph app there are differences in the number of artifacts (sometimes more, sometimes less) and the CEF detail in those of "Email Artifact" type. Even in the containers generated by the Graph app the different email artifacts created during ingestion (ex: from an email with other emails attached) have different structures, some of them similar or maybe equal to the CEF structure generated by the EWS and the Parser apps and some with a new structure exclusive of Graph generated artifacts. Since the source of the emails is exactly the same and the output type is the same (Email Artifact) we expected the output content to be also the same. There are differences not only in the output structure, but in the content also, mainly in the body content and its parsing.   Has anyone found any documentation explaining the parsing process and the output structure? Any hints about the logic behind the different output data structures?   I'll mention some members who posted about related topics: @phanTom  @drew19  @EdgeSync @lluebeck_splunk ... View more