Splunk SOAR

Is it possible to add custom fields to a splunk phantom container schema programmatically?

ebarrameda
New Member

I am developing a Splunk SOAR app that retrieve a json from our backend and ingest it into a container in splunk soar. However, I need to show some fields that are not included in the container schema and i want those custom fields to be deployed with my app. Therefore my question, Is it possible to add custom fields to a splunk phantom container schema programmatically so our customers do not need to create them manually in the Splunk SOAR user interface?

Labels (2)
0 Karma

JackTheRipper
Loves-to-Learn

Have you thought about using the container API?

phantom.add_artifact(container=None, raw_data=None, cef_data=None, label=None, name=None,
    severity=None, identifier=None, artifact_type=None,
    field_mapping=None, trace=False, run_automation=False)

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...