Using the Splunk App for SOAR I am creating events in SOAR using a dashboard in Splunk. I'm facing an issue where the same form submission in the dashboard is resulting in multiple artifacts being created in the one event rather than a new event being created for all submissions. Events in Splunk are held for 30 days, this can results in a time sensitive request being requested and run 30 days ago for example, but if it's requested again n those 30 days it won't generate a new event and run the playbook. I could probably add a unique ID to the form submissions which would result in a new container being made (as the artifact values wouldn't be identical) but I was wondering if there's an option in the app or in SOAR to always generate a new container?    Thanks ... View more

I have a playbook setup to run on all events in a 10minute_timer label using the Timer app. These events do not contain artifacts. I've noticed the playbook runs fine when testing on a test_event that contains an artifact. When I moved it over to run on the timer label it dies when it gets to my filter block. I've also run the exact same playbook on an event in my test_label which also didn't contain an artifact and that too fails. I've tested it without the filter block and used a decision instead, that works fine. Both blocks share the same Scope in the Advanced settings drop down. My conditions are fine in the filter block and should evaluate to True, I added a test condition on the label name to make sure of this and even that is not triggering.  I think this may be a bug, I'm open to being wrong but not sure what else I can do to test it.    Thanks I believe this is a bug with SOAR.  ... View more

So I've got a list containing multiple strings, depending on these strings I want to run 1 or more actions using a filter. When I use the 'in' filter to check if a certain string is in the list the matching condition is not met.  Example input = ['block_ioc', 'reset_password'] Filter block: I can successfully use the 'in' condition in a decision block, just not a filter block.    Any ideas?    ... View more

I have an input playbook with two output variables. I can retrieve these variables when I call the playbook using the playbook block in the UI. However, I now need to loop over items in a list and call the playbook for each item in that list, this requires using the phantom.playbook function. From what I can see, there is no way to retrieve the output of this playbook now, is that correct?   Example below: for item in prepare_data__post_list: phantom.playbook(playbook="local/__Post_To_Server", container={"id": int(container_id)}, inputs={"body": item, "headers": prepare_data__headers, "path": prepare_data__path}) ... View more