@annielee have you tried using the relevant .whl file for the 2 libs and adding to the app as a wheel dependency?  --- Hope this helped? Happy SOARing! --- ... View more

@mpc7zh  OpenSSL 1.0.2zj-fips 30 Jan 2024 ... View more

@hiepdao whilst on-prem it should be fine but you may need to check if the lib ever needs an update.  The best practise, especially if you ever move to Cloud SOAR, would be to create an app for the actions requiring pandas and then package the pandas .whl file as a dependency to make it more portable.  ... View more

@souha  Splunk SOAR (On-premises) supports these operating systems and versions: Red Hat Enterprise Linux 7.6 through 7.9 Red Hat Enterprise Linux 8.0 and any of the minor versions of 8. You can use the most recent minor release of RHEL 8 that is available at the time of the Splunk SOAR (On-premises) release. Amazon Linux 2 Oracle Linux 8 If you are unable to use any of these then you should raise a support case to see if they can help.  I think you could edit the install script to allow for another *nix OS but then you would be out of any support entitlement.  ... View more

@marnall I think the cleanest way, until they fix it, would be to build a Custom Function that uses REST to check the for the <thing> you want and then output a boolean to then use downstream.  At least the CF could be made re-usable for similar use cases.    ... View more

@mrilvan there is only a Splunk app for that at the moment and nothing on the SOAR Side. However if the API is available there is nothing stopping you building a custom app in the platform as I am sure XSOAR is just another REST API.   ... View more

@sayala Firstly, I would say this is a "not best practise" use of tags for the reasons you are coming up against now.  Surely something like a custom field would be better as you can both populate and use in anyway you want and it comes into Splunk too with the container data if you are using the tags for trending etc? I can't see a REST endpoint for tag management at a system level as this would be your best option to do it at any scale.  Unfortunately, for now and without a lot of potential digging, you will need to delete manually.  I would advise you to think of a different way though otherwise you will face a buggy UI going forward.  Hope this helped!? Happy SOARing ... View more

@T_K_421 Based on what you are seeing the likely issues are either Network or Permissions on the Azure side.  If you followed the instructions then it should work. It may be worth either re-validating the existing config or starting again.  ... View more

@Iñigo you can already make dynamic list options in the prompts but you need to use custom code and bear in mind it "breaks" the VPE control of the prompt block. You can use any of the API options to grab the dynamic fields you want to use then you just need to build the  choices variable in response_types and the prompt will show them. The issue you will have though is then how to handle the response if they are truly dynamic. i.e how would you know what they could choose to then handle the response. It can be done but needs to also be considered.  # responses response_types = [ { "prompt": "", "options": { "type": "list", "choices": [ "a", "b" ], }, } ] ... View more

@N_K  You can make an action block loop through a list of parameters with the right input from a format block. With the HTTP app it may be harder to do as there are a lot of potential parameters.  Yeah, please don't try to use requests outside of an app space 😄  Depending what you are using the HTTP app for it may be best to build an app to handle it as you get a lot more control over the behaviour and the HTTP app, IMO, is usually only useful to test interactions with external APIs OR simple HTTP related tasks.  How many parameters are dynamic when using the HTTP app?  ... View more

@N_K I would recommend that you make the input playbook capable of handling list items as inputs and doing the iteration inside the playbook as it will be the path of least resistance and put less strain on the platform from a worker perspective.  ... View more

@johnlee2327  Firstly I would not recommend you use this in email as you will need to embed the username & password in to the link you give.  External prompts are coming in the next release AFAIK so you may not want to expend a lot of energy on this to then have it natively available.  For your question I thin you just need to put "deny" as a string not a list object.    -- Hope this helps. Happy SOARing -- ... View more

@catherinelam "warm standby" is the architecture and Primary / Secondary is the server role. One is only active at any one time.  ... View more

@meshorer  The IN operator will only look for the entire entry in the list so won't work as you cant wildcard the entries. You may have to pull in containers within a date/time range and then do some post-processing in custom code to grab what you need from the returned values.  ... View more

@ivan5593  This is certainly possible using an authentication account which will give you a token to interact with the SOAR API.  The you just need to use the correct API endpoint with the correct payload to send events to SOAR: https://docs.splunk.com/Documentation/SOARonprem/5.3.1/PlatformAPI/Using  If you want to initiate a playbook from JIRA than you need the playbook_run API endpoint with the correct payload.  I would also say that the JIRA app has an On Poll action that you can setup with some JQL to only pull in what you want and it will just create containers for you whenever it polls and finds something new. This would be better if you had playbooks that ran on ingestion into SOAR.  -- Hope this helps! If so please mark as a solution for future. Happy SOARing!  -- ... View more

@harishlnu  For the forwarding part: https://docs.splunk.com/Documentation/SOARonprem/6.2.1/Admin/Forwarders  The other element is just using SPL to look for things in the logs sent from SOAR to Splunk. The Splunk app for SOAR will have docs on what sourcetypes it sends through that would include ingestd.log.  You should have enough information now to do some research and start to develop what you need.  -- Happy SOARing -- ... View more

@harishlnu  If a Correlation Search is configured to send to SOAR then you just need the _internal logs for the modaction send_to_phantom to be checked for failures in sending then also use the ingestd.log to look for failures to ingest on the SOAR side. The ingestd.log should be one of the DAEMON logs you can forward from SOAR to Splunk.  ... View more

@harishlnu if you have one of the more recent versions of SOAR then it now has a forwarder on it with the ability to send a lot of different logs to Splunk via the UF embedded in the platform. There is a huge amount of data in these logs that could be teased out into SPL Alerts.  Are you able to advise what kind of things you are looking to monitor? OS Health can be done using the *nix Splunk Add-on, playbook/action failure is in the logs as well as access data via the wsgi.log file. Daemon logs, such as decided/ingestd/etc can also provide data about functionality and these are also able to be sent to Splunk via the Forwarder Settings in Administration in SOAR.    -- Hope this helps! Happy SOARing -- ... View more

@harishlnu one way I have done this in the past is to use 2 lots of automation.  1st automation sends the email with a key nested in the HTML such as "SOARKEY=" and then add useful information to the other side, usually b64 encoded, at a minimum having the original container id in it. This sends the email and then stops automation.  Then you ingest the replies (you may need to setup mail rules to push replies to SOAR emails into a dedicated inbox) using SOAR and look for the SOARKEY in the HTML Body, get the encoded string, decode and then <do something>.   -- Hope this helps! Happy SOARing! --  ... View more

@SOARt_of_Lost the only way I can think of initially is to have a scheduled playbook to check for containers from notables without artifacts and then run the relevant playbook against them. Timer app would be used to create the container to kick the utility playbook off as regularly as you want.  ... View more

@meshorer there isn't anything inbuilt, but there is a Custom Function in the community Repo called "find_related_containers" which should get you somewhere close to what you want. TBH I would recommend building your own but it can be complicated depending on how you want to define "relevant" containers.  As for the playbook logs, I am not sure where they are on-disk. I can't see anything in $PHANTOM_HOME/var/log/phantom but suspect they are somewhere on the system.  ... View more