Splunk SOAR

How to retrieve the full raw object of app action?

CS_
Path Finder

Hey,

Is there a way to retrieve the raw object of an app action in phantom.collect?

So I have an app, which returns the following values:

data, message, status, parameter

And normally that works fine - I can call each of these in turn like this;

 

 

data_result = phantom.collect(container=container, datapath=["my_app_action:action_result.data"])
message_result = phantom.collect(container=container, datapath=["my_app_action:action_result.message"])

 

 

etc.

 

but how do I retrieve the full object? e.g. something like this:

 

 

all_result = phantom.collect(container=container, datapath=["my_app_action:action_result.*"])
all_result = phantom.collect(container=container, datapath=["my_app_action:*"])

 

 


Hope that makes sense.

Labels (1)
Tags (1)
0 Karma
1 Solution

CS_
Path Finder

After a bit more playing around and reading the documentation, i think I've found a way. You just call multiple datapaths at once:

 

paths = ['my_app_action:action_result.data',
'my_app_action:action_result.parameter',
'my_app_action:action_result.summary']

data_result = phantom.collect(container=container, datapath=paths)

 

This returns the values in the 3 datapaths all part of the same list item.

View solution in original post

0 Karma

CS_
Path Finder

After a bit more playing around and reading the documentation, i think I've found a way. You just call multiple datapaths at once:

 

paths = ['my_app_action:action_result.data',
'my_app_action:action_result.parameter',
'my_app_action:action_result.summary']

data_result = phantom.collect(container=container, datapath=paths)

 

This returns the values in the 3 datapaths all part of the same list item.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...