I ended up achieving what I wanted. In summary, I created an asset that essentially performs an on-poll action. To handle configuration dependencies, I introduced custom variables, including: Custom List Sample Container ID (this container should not be deleted) Splunk SOAR URL ph_auth_token Next, I created a set of custom lists that act as scheduling buckets: Scheduled_Playbooks_List_1_min Scheduled_Playbooks_List_5_min Scheduled_Playbooks_List_15_min Scheduled_Playbooks_List_30_min Scheduled_Playbooks_List_1_hour Scheduled_Playbooks_List_3_hour Scheduled_Playbooks_List_6_hour Scheduled_Playbooks_List_12_hour Scheduled_Playbooks_List_1_day Finally, I deployed custom assets for that app and assigned each one a polling interval corresponding to the intended schedule. Note: Initially, I utilized phantom automation functions in python. import phantom.rules as custom_phantom
container_obj = custom_phantom.get_container_id(2607)
playbook_run_id = custom_phantom.playbook("XXX", container=container_obj)
custom_phantom.debug(f"::{playbook_run_id}::") However, this returned -1 as the result, so I used REST API.
... View more