I'm a bit confused about how you're getting data to your SOAR instance - you say you're pulling, but you're also using the Splunk App for SOAR Export? When I hear pull, I'm assuming you have the SOAR App for Splunk configured to pull events in from SOAR (yes, I know the app names are all similar and this definitely caused some confusion for my team early on)   Assuming you just have the event forwarding configured, you can maybe try changing your advanced options to this: This would send everything as a single artifact, rather than the multiple you have. ... View more

Before you format your table, you'll need to take your return value in the array and convert it to a string. You will need to do some custom code for this. The beauty of SOAR is that you're able to throw in some python code to manipulate the data in whatever way you want it to. ... View more

You're definitely on the right track with your method - you wouldn't actually need to add in the custom code block for this, you can just add it into the commented section of your action block. Depending on your use cases and if it's something you expect to need to do often, it might warrant a custom function.  An alternative, if you're only ever expecting a single value returned in that list, could be to use the format blocks, but it's definitely not as clean a solution there. If you haven't read through it yet, this was a super helpful link in the documentation to help jumpstart my overall SOAR knowledge - https://docs.splunk.com/Documentation/SOAR/current/PlaybookAPI/Datapaths ... View more

This worked like a charm - thank you! ... View more

So there's a couple ways you could approach this: 1. Less elegant solution - you can add in a decision/filter block to the existing playbook that runs every time to check for the tag. If the tag matches continue, otherwise, end the playbook. 2. If you truly don't want the playbook to run at all, I think you'll need to make a parent playbook with a decision or filter, and call the subplaybook from there. The parent playbook will still run on all events with the label, but the playbook you want to run wouldn't run at all. I added on the screenshot for the datapath you'd need to match the container tags. ... View more

I know this is a couple month's old at this point, but there's not built-in support within SOAR to run your PowerShell Script. However, you can use the WinRM app to connect to a proxy server of sorts, and then run your powershell script on that machine. ... View more

I think what you may be looking for is something like the following: Action block that queries AD for the OU the object is in.  The object (ip_hostname in your example) is configured as the input at the start of the playbook Decision Block checking if the OU matches your condition My org had some trouble with these initially, you should configure these like below (rather than the opposite direction,  which is what we were trying initially)   if <artifact_datapath> == <the OU you're trying to match>​ 3. Each path on your decision block then has a custom code block. You'll need to configure an output variable for the custom block themselves and set it to either True/False  4. The output of your entire playbook will be set to the variable you configured in step 3.   ... View more