I'm trying to add a condition in a playbook (version 5.2.1.78411) that will test the current day of the week. At the moment, I've been trying to get current_date:now.day_of_week to evaluate - choosing any of the 'day of week' values seems to insert a number (string?) between 01 and 07. As far as I can tell, the case in the screenshot should evaluate as 'true', but it isn't, and for good measure I've tried all of the other possible options in the "day of week" selector. Any idea what I'm doing wrong here? ... View more

I have some Phantom playbooks performing tasks that I want to monitor on a Splunk dashboard - runs/day, distinct tasks processed per run, success/retry/failure, things like that. I can see the revision control check-ins by playbook name, but not the individual playbook runs - those are identified with an integer that corresponds to the playbook ID. The playbook ID changes for each check-in and doesn't appear to be included in the check-in event. Surely someone must have set up a way to track Phantom playbook runs from a Splunk dashboard with a human-readable playbook name  - how should I start going about this? ... View more

I have a playbook that adds a row to a custom list for each task that can't be processed at runtime, and I'm building a second timer-driven playbook that should retry each of those actions. Each row has five columns, four for the values needed to attempt the action and a counter that should be incremented for each retry (after five tries, it should remove the row and alert that the task can't be performed automatically).  I can use phantom.get_list() (and capturing only the third element, which is the list contents) to get the contents of the custom list into the retry playbook as a Python list, but I'm having trouble coming up with a way to iterate through them. I've tried the recommendation in another question/answer (https://community.splunk.com/t5/Splunk-SOAR-f-k-a-Phantom/How-do-you-achieve-quot-for-quot-loops/m-p/615841), but passing the retrieved list from a code block into a format block with  %% {0} %% as the format, then doing a python.debug on format_1:formatted_data.* just returns the monolithic list once. The behavior I need is for it to spin up the code block for each row of the incoming list. Is this possible with Phantom? If so, is this approach correct, and what might I be doing wrong here? ... View more