@phanTom wrote:  #PeopleWillPeople Ain't that the truth haha. End users, I'd love them if I didn't hate them sometimes 🙂 Thanks for the reply as always - food for thought. I can always build a webapp to supplicant SOAR - so that reads the response, and updates the relevant container. Just a lot of extra work. I'll just guess it's "not possible at present" 🙂 ... View more

Yep - just like @phanTom  says - you can check the "status" output for an app action. I would do something like this: The decision checks the status of the Splunk "Run Query" app action, if successful; end, Else; send an email. You can do stiff with "try/except" in regular codeblocks but to be honest they become  a pain to manage in larger playbooks.  I know when i started with playbooks, i had to try and unlearn how I'd do it in python, and think about it in terms of SOAR's playbook capabilities, but I am better off for it 😄   ... View more

We use the 'Crowdstrike OAUTH API' app. We don't do any ingestion of events directly to SOAR, we send them to Splunk instead, and call SOAR to do the work by various Adaptive Responses. Our SOAR, Splunk and Crowdstrike are all in the cloud. We haven't had any issues at all with reaching CS. I'm assuming you're self hosting SOAR - as you mention it calling out through the proxy. Do you have any other things in the way, like Firewall, IPS, etc that might be causing a block? A weird DNS issue maybe? I suppose a failure to resolve the crowdstrike domain would probably show up in the logs. Have you tried with a different set of crowdstrike credentials? Maybe something funky with the current account? When it seems to stop working - have you tried manually polling it in the App Asset Settings to see if that works? One thing you could try - is disable the automatic polling, create  playbook that polls for events, then set that playbook to run on a timer as detailed here - we do this quite a lot for various playbooks that need to run like a cronjob. ... View more

@phanTomgood to see you still kicking about the Forums! 🙂 Pretty much did what you recommended. I spent a few days figuring out how the app works (Spoiler: Whoever coded it hates other people). Built a custom version of the app which can now do all that i need and more. Plus side; it was good to flex the app building muscles and keep them in shape lol Thanks! ... View more

I just wrote a quick script to handle it, using multiprocessing. If  you want to use it, just be careful how many API requests you are sending to your SOAR instance, and that it can handle it. Use at your own risk. import requests import multiprocessing headers = {"ph-auth-token": "<some auth token here>"} label = "<some label here>" soar_base_url = "https://<replace_me.with.soar.url>" # A function to for multiprocessing def delete_container(container_id): requests.delete("{}/container/{}".format(soar_base_url, container_id), headers=headers, verify=False) print(container_id, " - Deleted") # This is an example search that will get 50 Events from a label that are in the "new" status # It will then sort them in ascending order (oldest to newset) res = requests.get("{}/container/?page=0&page_size=50&sort=id&order=asc&_filter_label__in=['{}']&_filter_status__name='new'".format(soar_base_url, label), headers=headers, verify=False) container_ids = [container_id["id"] for container_id in res.json()["data"]] for container_id in container_ids: p = multiprocessing.Process(target=delete_container, args=(container_id,)) p.start() ... View more

Hey @phanTom  Once again you've saved me a lot of grief. You are 100% correct. So I had an action in my decision tree (for the else) which wasn't being run, but was still required on the "join_*" function. I removed the tick for required, and now it's working as expected. Can't believe I haven't come across this issue before, but happy to know it's just a simple setting to change to resolve it. Thanks a million, I owe you a beer/coffee! ... View more

@phanTomAs always, you've dropped the perfect answer. Many thanks! I'll give this a try (from the first URL you provided) phantom.delete_from_list(list_name=None, value=None, column=None, remove_all=False, remove_row=False)   ... View more

Yes you can. We have several Virtual servers running on ESXi, and we have broker docker containers running on them. The only issues we're experiencing is occasional errors in SOAR that say "Failed to communicate with Automation Broker" - which I think is a result of our corporate network more than anything else. But as long as your VM can communicate with SOAR, I can't see any reason why a broker wouldn't work on the VM. ... View more

Hey @phantom_mhike  Yeah that's more or less what i've been doing. Run action, pass to code block or custom function, if the data i need is there, return a success, have decision handle what to do if returned answer is success or not. If that's the "accepted" way to do it, i'll soldier on with it. Thanks for the input! ... View more

Awesome, thanks a lot for the input, I've definitely learned form it 😁 ... View more

Hey @phanTom  I'm using SOAR  Cloud 5.2. So it's kind of a weird one - An event comes in, Playbook A runs automatically, which enriches the event with additional data. Then at a later date, an analyst may decide to run Playbook B, which creates a ticket in our Case Management System. So I don't think we can run action from A, and pass the result to B, because B is run manually (or maybe not even at all!). Getting the action_run details through REST looks like another good way to do what we need - I'll take a look into that. The persisting data isn't that much of a concern, as we have left auto_delete=True, so when the container is closed, these objects are removed. Is there a way to call the RESTQueryData inside a SOAR playbook? e.g. phantom.query("QueryData") or something? I don't think I have ever tried to use a rest query like that in SOAR. I can do it with CURL but no idea how to do in a Playbook. I might have another potential solutions in the phantom.save_run_data() and phantom.get_run_data() although I haven't actually tried those yet. ... View more