Splunk SOAR

Is it possible to add a task in phase of a workbook in a particular container via api?

ansir
Explorer

Hi,

is it possible to add a task in a phase of a workbook in a particular container via an api call?

thanks for the help.

 

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

That should work.

Here is a screenshot of the code I use in a CF:

phanTom_0-1669038902401.png



phanTom_1-1669038914142.png

 

The only difference I can see is that I specify int() for the phase_id value.

-- If this solves your issue please mark as a solution. Happy SOARing! --

View solution in original post

0 Karma

phanTom
SplunkTrust
SplunkTrust

@ansir you can use the phantom.add_task() API: 
 https://docs.splunk.com/Documentation/SOARonprem/5.4.0/PlaybookAPI/ContainerAPI#add_task 

However, this doesn't provide many options so I like to use REST:
https://docs.splunk.com/Documentation/SOARonprem/5.4.0/PlatformAPI/RESTWorkbook#.2Frest.2Fworkbook_t... 

 

-- If this solved your issue please mark as a solution! Happy SOARing! --

0 Karma

ansir
Explorer

Hi thanks for your quick repose. 

can you give an example of a post request to add task to existing phase within a particular container?

regards, 

 

 

0 Karma

phanTom
SplunkTrust
SplunkTrust

@ansir did you check the docs links? The example is in there:

{
	"name": "My Task",
	"order": 1,
	"owner": 2,
	"phase_id": 20,
	"description": "Investigate the event",
	"playbooks": [{
			"scm": "local",
			"playbook": "investigate"
		},
		{
			"scm": "community",
			"playbook": "04_07_2017 - PhishMe"
		}
	],
	"actions": ["geolocate ip", "block_ip"]
}'
0 Karma

ansir
Explorer

hi,

i have used the get_phase api to get the id of a phase of a particular container.

id = phantom.get_phase(container=id_value, trace=False)

which returned id 94734,

then i did the following post request: 

`

{"name": "new task",
"order": 2,
"phase_id": 94734,
"description": "test description",
"playbooks": [{}],
"actions": []}

`

 to the  "workbook_task_template endpoint"  to add a task to phase_id 94734.

I'm getting the following failed response

: {\"failed\": true, \"message\": \"Invalid value \\\"94734\\\" for parameter \\\"phase_id\\\"\"}"}]

not sure why this is the case since the phase id currently exist.

0 Karma

phanTom
SplunkTrust
SplunkTrust

That should work.

Here is a screenshot of the code I use in a CF:

phanTom_0-1669038902401.png



phanTom_1-1669038914142.png

 

The only difference I can see is that I specify int() for the phase_id value.

-- If this solves your issue please mark as a solution. Happy SOARing! --

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...