Hey @phanTom I'm using SOAR Cloud 5.2. So it's kind of a weird one - An event comes in, Playbook A runs automatically, which enriches the event with additional data. Then at a later date, an analyst may decide to run Playbook B, which creates a ticket in our Case Management System. So I don't think we can run action from A, and pass the result to B, because B is run manually (or maybe not even at all!). Getting the action_run details through REST looks like another good way to do what we need - I'll take a look into that. The persisting data isn't that much of a concern, as we have left auto_delete=True, so when the container is closed, these objects are removed. Is there a way to call the RESTQueryData inside a SOAR playbook? e.g. phantom.query("QueryData") or something? I don't think I have ever tried to use a rest query like that in SOAR. I can do it with CURL but no idea how to do in a Playbook. I might have another potential solutions in the phantom.save_run_data() and phantom.get_run_data() although I haven't actually tried those yet.
... View more