About CS_

CS_

@phanTomAs always, you've dropped the perfect answer. Many thanks! I'll give this a try (from the first URL you provided) phantom.delete_from_list(list_name=None, value=None, column=None, remove_all=False, remove_row=False)

CS_

In a playbook, I have a decision tree. If option A -> Check List -> If Value Exists in custom list -> Do Nothing Else If Option b -> Check list -> If Value Exists in custom list -> Delete that list entry. Checking in the SOAR Phantom app actions, I see several options for lists, but no option to "remove/delete listitem" (see attached pic) How do I go about deleting items from a Custom List? Thanks! (SOAR Cloud 5.3.1)

CS_

Yes you can. We have several Virtual servers running on ESXi, and we have broker docker containers running on them. The only issues we're experiencing is occasional errors in SOAR that say "Failed to communicate with Automation Broker" - which I think is a result of our corporate network more than anything else. But as long as your VM can communicate with SOAR, I can't see any reason why a broker wouldn't work on the VM.

CS_

I've seen an answer to this before, because I wanted to do the exact same thing. There's no setting or kind of intuitive way to do it. However in this post it details a way to accomplish it, and it works fairly well. https://community.splunk.com/t5/Splunk-SOAR-f-k-a-Phantom/How-to-schedule-a-Phantom-playbook-to-run-at-specific-intervals/m-p/500566#M382

CS_

Hey @phantom_mhike Yeah that's more or less what i've been doing. Run action, pass to code block or custom function, if the data i need is there, return a success, have decision handle what to do if returned answer is success or not. If that's the "accepted" way to do it, i'll soldier on with it. Thanks for the input!

CS_

I'm interested in suggestions on how to tackle this. I know how I would implement it in Python, but not really sure best practice for SOAR. Let's say I have an Action called "Lookup Host" If it runs successfully, it returns a dict with some data [{"hostname": "test1", "device_id": "abc123"}] but we might actually not have data on this host, so it will return empty: [] I need to ensure that we have data, otherwise later playbook actions won't complete. Would we use a decision here - like "If result != []: continue, else: exit playbook" Here's is loosely what I want to do, but in Python Code: result = LookupHost(hostname="test1") if result: # Have a result, so can continue run_second_action() else: # no data found, exit exit(0)

CS_ · ‎03-09-2022

Awesome, thanks a lot for the input, I've definitely learned form it 😁

CS_ · ‎03-09-2022

Hey @phanTom I'm using SOAR Cloud 5.2. So it's kind of a weird one - An event comes in, Playbook A runs automatically, which enriches the event with additional data. Then at a later date, an analyst may decide to run Playbook B, which creates a ticket in our Case Management System. So I don't think we can run action from A, and pass the result to B, because B is run manually (or maybe not even at all!). Getting the action_run details through REST looks like another good way to do what we need - I'll take a look into that. The persisting data isn't that much of a concern, as we have left auto_delete=True, so when the container is closed, these objects are removed. Is there a way to call the RESTQueryData inside a SOAR playbook? e.g. phantom.query("QueryData") or something? I don't think I have ever tried to use a rest query like that in SOAR. I can do it with CURL but no idea how to do in a Playbook. I might have another potential solutions in the phantom.save_run_data() and phantom.get_run_data() although I haven't actually tried those yet.

CS_ · ‎03-09-2022

I think i've found a way to do this. In my initial playbook, when an app function runs, I call "phantom.save_object" and save the data that way. Then in a later playbook, i can do "phantom.get_object" which will pull back the saved object in my container. This seems to work fine for my purposes. Details on save/get object are here for anyone who is interested in reading up on them: https://docs.splunk.com/Documentation/Phantom/4.10.3/PlaybookAPI/DataManagementAPI

CS_ · ‎03-07-2022

Hi all, I have a stream of events which come in to SOAR. When the event is loaded in SOAR, a playbook runs against it automatically - and this calls an App action, which completes successfully and returns data. In another playbook, which will be manually run, how do I access the data returned by the App action? Do I need to save the app action data as a new artifact, and call it that way, or is there a way to list all app actions in a container, and get the app action ID, and retrieve the data? Thanks!

CS_ · ‎02-21-2022

Hey @phanTom Thanks for the response. Luckily there is no loss of important data, they were just test events we were sending from Splunk. If there is no way to do it through the frontend, I'll mark it as a "cannot be done". Best, Chris

CS_ · ‎02-21-2022

I read in another thread that events are not really "deleted" as such, but that they are simply marked in a way that removes them from the search - however that may be just relating to SPLUNK. So if you have a need to restore a deleted event + it's associated containers, actions, logs, etc, is there a way to do that in SOAR/Phantom

CS_ · ‎02-16-2022

We were able to get it working by amending the source type on the HEC token, and setting the character limit to 1mb (1,000,000 characters)

CS_ · ‎02-15-2022

thanks @tshah-splunk I'll have a look and see if I can make that change. will update with result. -C

CS_ · ‎02-15-2022

Hi all, We are using Splunk Cloud, and I am using the https://http-inputs-mydomain.com/services/collector/raw to send a log file for ingestion. The problem is that each line in this log file can be quite big, 25000 characters or more. Splunk Cloud is truncating at 10,000 characters. I can find steps for handling this on Splunk On-Prem for Heavy Log Forwarders etc. but doesn't seem to be addressed for the http-inputs on cloud. Any idea's on how I can change it to accept larger logs? Thanks, Chris

CS_ · ‎01-26-2022

Hi all, Does this Add-On support Azure Certificate Based Authentication? The documentation seems to have steps for using Client ID + Client Secret, and doesn't mention Certificate Based Authentication, but wanted to double check. Thanks, Chris

Posts	17
Solutions	3
Karma Given	5
Karma Received	5
Member Since	‎01-26-2022

Online Status	Offline
Date Last Visited	2 weeks ago

Deleting Custom List Items

Validating data of an action inside a decision?

How to get app action result in a playbook?

Can deleted events be restored?

How to set Splunk Cloud HTTP-INPUT Truncating to 1...

Microsoft O365 Email Add-on for Splunk - Certifica...

Re: Deleting Custom List Items

Deleting Custom List Items

Re: Can the Automation Broker be installed on a vi...

Re: Trigger a Splunk SOAR Playbook on a schedule

Re: Validating data of an action inside a decision...

Validating data of an action inside a decision?

Re: How to get app action result in a playbook?

Re: How to get app action result in a playbook?

Re: How to get app action result in a playbook?

How to get app action result in a playbook?

Re: Can deleted events be restored?

Can deleted events be restored?

Re: How to set Splunk Cloud HTTP-INPUT Truncating ...

Re: Splunk Cloud HTTP-INPUT Truncating to 10000 Ch...

How to set Splunk Cloud HTTP-INPUT Truncating to 1...

Microsoft O365 Email Add-on for Splunk - Certifica...