About scorsatto

scorsatto · ‎09-04-2023

I have a Splunk alert where I specify the fields using "| fields ErrorType host UserAgent Country IP_Addr" and I want to receive this column order in SOAR platform. When I look at the JSON results and UI from SOAR, the column order has changed to host, Country, IP_Addr, ErrorType and UserAgent (not the expected results). I think this has to do with the REST call and Json data, but I would like to check if there is any quick fix we could do from splunk or SOAR side to show the proper order of columns. Any help on this will be much appreciated.

scorsatto · ‎11-11-2022

yup, I'll need to use a hashing.. I would be great to have this such functionality in the app development, like a new command to pass the results only without save the data to the container. Thanks @phanTom for your help!

scorsatto · ‎11-11-2022

Hello @phanTom, the app will be used to retrieve secrets from another tool like passwordVault, if there is no other alternative, I think I'll have to hash the password to avoid any exposures.

scorsatto · ‎11-10-2022

I'm creating a custom application in SOAR and one of the fields this custom application provides is a password information, for obvious reasons, I don't want to store the password in the container, rather I just would like to add it in a parameter that I can use during playbook execution only. is there any way I can do it? Version: Splunk SOAR 5.2.1.78411 What I'm doing today in my custom app is: if secret_value: self.save_progress("Secret value retrieved successfully") action_result.add_data({"succeeded": True, "secret_value": secret_value}) return action_result.set_status(phantom.APP_SUCCESS, 'Successfully retrieved secret value') but the secret value is saved in the container.

scorsatto · ‎11-07-2022

Thanks @Dave_Burns and @phanTom. that exact what I did, I've created a new CF that get all the data from the artifact first, after that changes the fields I want and then I can use this CF payload result in the update artifact action. it seems the interface always replace the whole artifact data with whatever you post, this is not very clear on the documentation of the app

scorsatto · ‎11-01-2022

is there an option to update the value of a specific field within a specific artifact? I was able to update using phantom update_artifact action or with a REST call, but when the field is updated it also delete the other existent fields in that artifact.

scorsatto · ‎08-31-2022

Thank you for this, I was having the same issue. Indeed we can only test the asset user/password after we install the app. this is an improvement opportunity I would say for SOAR, as we can't test it before deploy the app

Posts	7
Solutions	2
Karma Given	1
Karma Received	0
Member Since	‎08-31-2022

Online Status	Offline
Date Last Visited	‎09-04-2023 06:02 PM

Why is SOAR is not respecting the order of columns...

Container data vs Custom Application Results

How to update an artifact field?

Why is SOAR is not respecting the order of columns...

Re: Container data vs Custom Application Results

Re: Container data vs Custom Application Results

Container data vs Custom Application Results

Re: How to update an artifact field?

How to update an artifact field?

Re: While developing a custom app, how to decrypt ...