Splunk Enterprise Security

Phantom: Playbook that Prompts for User Input

jamolson
Path Finder

Wondering if Phantom has the ability to prompt for user input in a playbook.
Like a simple text box popup to allow for more dynamic notes.

From what we have seen it seems like you can really only do this with an App but that seems a bit much for some situations.
If anyone has done this, could you share how you did it?

0 Karma
1 Solution

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

View solution in original post

jamolson
Path Finder

So we found a work around for those interested.
We used the built in prompt function and use the effective_user_id and rest to make sure the prompt is sent directly to the user that ran the playbook.

import requests
import json
container_id=container.get("id")
effective_id = phantom.get_effective_user()
r = requests.get("https://127.0.0.1/rest/ph_user/" + str(effective_id),verify=False)
result = json.loads(r.content)
user = str(result['username'])
message = """Prompt Message."""

phantom.prompt(container=container, user=user, message=message, respond_in_mins=10, name="prompt_1", callback=add_comment_6)

This seems to work well, if anyone has found a better way please share.

sloshburch
Splunk Employee
Splunk Employee

@jamolson - Assuming you don't mind, I cleaned up the markup so your solution renders like code. Also, thanks so much for posting and accepting your own answer! Others will now benefit from your efforts!

0 Karma

jamolson
Path Finder

Absolutely, I have not responded to many questions so I was not sure how to tag the lines to do that.
Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...