Splunk SOAR (f.k.a. Phantom)

Phantom Playbook calling playbook block synchronous

dphegarty
New Member

I have a top level playbook that calls two playbooks, on that does some analysis and the second one that promotes the event to a case based on artifacts created by the first playbook and it does not appear to honor the Synchronous flag

Playbook 1
Calls Playbook A that does some analysis
Playbook A calls Playbook B based on some indicators to query Splunk for additional data and adds new artifacts.
Calls Playbook C that will promote the event to a case and send out email notifications based on data in the artifacts'

All the Playbook blocks have Synchronous turned on and yet the Playbook C runs immediately after Playbook A launches. Playbook C does not wait for Playbook A to finish .

I've created some simple Playbooks to test Synchronous and it does not appear to exhilarate the behavior stated in the documentation:

To set the called playbook to run in synchronous mode, click the Synchronous toggle. This makes the calling playbook wait for the called playbook to complete before continuing

What am I missing ?

Labels (2)
Tags (1)
0 Karma

dphegarty
New Member

Found the answer to this issues. There can not be multiple paths to the "End" block within the playbook that can evaluate to true. Multiple paths run in parallel and as long as one path reaches the end block the playbook is considered completed even if another path is still running.

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...