Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nongingerale
nongingerale
Explorer
Member since:
01-18-2023
02-12-2025
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 01-18-2023 |
Activity Feed
- Posted Sending Alert results sid only to SOAR on Splunk SOAR. 01-29-2025 12:24 PM
- Posted Is there a way for us to check/test connectivity across a list of assets from within a playbook? on Splunk SOAR. 07-05-2023 07:11 AM
- Posted Re: Format Code Block - error in expanding on Splunk SOAR. 04-20-2023 05:54 AM
- Karma Re: Format Code Block - error in expanding for phanTom. 04-20-2023 05:52 AM
- Posted How do I pass a dictionary into a Format Code Block - error in expanding on Splunk SOAR. 04-19-2023 07:22 PM
- Posted How to go through a list where each item is the input for a child playbook that return a json object? on Splunk SOAR. 03-28-2023 10:17 AM
- Posted Re: Code Block Self.Name type of param on Splunk SOAR. 02-14-2023 08:48 AM
- Posted Is there documentation on Code Block Self.Name type of param? on Splunk SOAR. 02-14-2023 08:16 AM
- Posted Re: Try Except functionality with playbook on Splunk SOAR. 02-14-2023 08:05 AM
- Posted Re: Is there a way to try 'except' functionality with playbook? on Splunk SOAR. 02-14-2023 08:05 AM
- Karma Re: Try Except functionality with playbook for phanTom. 02-14-2023 08:04 AM
- Karma Re: Is there a way to try 'except' functionality with playbook? for CS_. 02-14-2023 08:04 AM
- Posted Is there a way to try 'except' functionality with playbook? on Splunk SOAR. 01-18-2023 12:13 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-29-2025
12:24 PM
Hey there! I'm currently struggling to find a way to send the alert sid (commonly found under view results when using the Send Email action in the Alert config) to SOAR. Currently I'm able to send the results as multiple artifacts within 1 container via the Grouping checkbox. However if I have a result that holds over 5k+ events, then a container will hold 5k+ artifacts. What's interesting is that in each artifact within the container, there's a variable named _originating_search that has the SID I want to pass. Right now I only want this result sid (_originating_search) but I cant figure out how to do this. Any suggestions welcomed!
... View more
Labels
- Labels:
-
using SOAR ⁄ Phantom
07-05-2023
07:11 AM
Hi all - is there a way for us to check/test connectivity across a list of assets from within a playbook? I was looking through the documentation and haven't found information that says it is possible or not. I only see how to do it manually or with the rest api call app_status but no examples on how to use it within a playbook. Any help is appreciated!
... View more
Labels
04-20-2023
05:54 AM
thanks! that worked once i created a custom function (as opposed to passing the dictionary from a custom code block).
... View more
04-19-2023
07:22 PM
Hello - I'm trying to pass a dictionary into a format code block: for example: my_dict = {"hello":"world", "foo":"bar"}
and in the format code block i have: Contents of dictionary: {0}
where 0 is mycodeblockname:custom_function:my_dict.hello
and I receive a "error in expanding mycodeblockname:custom_function:my_dict.hello" message. I also tried using :, 0.hello, etc and it hasnt worked. Any suggestions are appreciated. i know that if I pass a dictionary or list from an action block then this works but a custom function doesnt work from what i can see
... View more
Labels
- Labels:
-
using SOAR ⁄ Phantom
03-28-2023
10:17 AM
Hi all! I'm trying to go through a list where each item is the input for a child playbook that return a json object. When I try to run it though, I receive this in the logs: "Ignoring child playbook <name of playbook> completion message since this playbook is already marked completed with status: success".
so then I tried using phantom.playbook() instead, but then the results variable doesnt include this json object even though the child playbook has that as an output.
What am I doing wrong or how can I make either option work for looping a child playbook? Thanks for any input!
... View more
- Tags:
- json
- splunk search
Labels
02-14-2023
08:48 AM
I'd want to make things are generalized as possible and avoid hard-coding anything (for scalability and good coding practice reasons), so if I were to (for example) have a separate function that takes in a variable for the name and the "error message" to include that in part of error handling, or similarly, if i were to incorporate simple try/except portions in my code where i want to include the name of the function (without hard coding the name) is that possible? currently I have things hard coded and the pass/fail option doesnt meet this need. If its not implemented then its definitely something that would be useful in later iterations of Phantom since itll help debugging (hardcoding the name at the moment is ok but not scalable)
... View more
02-14-2023
08:16 AM
Probably a silly question but for the life of me can't find documentation - when we create a code block, how do we call the the name of said code block? Currently want to add extra information in my error handling and want to include the name of the code block that it occurs under.
I tried variations of phantom.name, custom_function__name, custom_function.name/(), self.name, etc. Any help is appreciated!
... View more
Labels
- Labels:
-
development
-
using SOAR ⁄ Phantom
02-14-2023
08:05 AM
that makes sense, thanks for the help!
... View more
01-18-2023
12:13 PM
Fairly new to writing playbooks within Phantom and so far havent found documentation for this yet: I'm trying to create an email notification (or something along those lines) whenever a playbook fails to complete for whatever reason (main fail case is if a splunk search fails/job dies). Basically almost like a try/except block but in Phantom. Has anyone found a way to incorporate this in phantom?
... View more
Labels
- Labels:
-
development
-
using SOAR ⁄ Phantom
