Splunk SOAR

How to decrypt the password from the asset, while developing a custom app?

victor_menezes
Path Finder

Hi everyone,

I'm looking for a solution here while playing around with the app builder on SOAR, and I could get the asset interface work fine and from the code I can get the values from there, but the password type returns as an encrypted string instead (as the field is a password field).
How can I decrypt it so the code can use that value in runtime accordingly?

Labels (3)
1 Solution

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

View solution in original post

phanTom
SplunkTrust
SplunkTrust

This is a bug and is resolved in the latest version past 5.3.x 

One way is to publish and test, or another is to hardcode the relevant details in whilst using the IDE, then remove before publishing. This will allow for the use of the IDE whilst testing but you need to remember to remove before publishing. 

0 Karma

hariomenkel
Explorer

I struggled with the same issue and it turns out that while developing you can't view the real values. I just checked this with an app where I passed a password parameter as data to a request in development mode and once after publishing the app:

hariomenkel_0-1661769251978.png

The first attempt shows the still encrypted value being passed to the function and after deploying, the decrypted value gets passed.

Long story short: To get the decrypted value you first need to deploy the app (I think)

victor_menezes
Path Finder

Thanks @hariomenkel. Works like a charm!

0 Karma

scorsatto
Explorer

Thank you for this, I was having the same issue. Indeed we can only test the asset user/password after we install the app. this is an improvement opportunity I would say for SOAR, as we can't test it before deploy the app

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...