Splunk SOAR Cloud

https://help.splunk.com/en/splunk-soar/soar-cloud
Admin
Splunk SOAR Cloud is a security orchestration, automation, and response platform that helps...
Tokens:284,030
Snippets:1,956
Trust Score:10
Update:1 year ago
Show doc for...
Tokens:
Raw
### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/customize-the-format-of-your-splunk-soar-cloud-playbook-content

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/use-decisions-to-send-artifacts-to-a-specific-downstream-action-in-your-splunk-soar-cloud-playbook

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/require-user-input-using-the-prompt-block-in-your-splunk-soar-cloud-playbook

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Compile and Install ipinfoio App

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/tutorial-use-the-splunk-soar-cloud-app-wizard-to-develop-an-app-framework

This snippet demonstrates the command-line process for compiling the ipinfoio app and installing it. It involves running a Python script to create a TAR file and then using a command to install the app.

```bash
cd'ing into ./
Compiling: ./ipinfoio_connector.py
Compiling: ./ipinfoio_consts.py
Compiling: ./__init__.py
Validating App Json
Working on: ./ipinfoio.json
Looks like an app json
Processing App Json
Processing actions test connectivity
No further processing coded for this action
geolocate ip
Following required data paths not in output list action_result.data action_result.summary
lookup ip
Following required data paths not in output list action_result.data action_result.summary
Installing app...
Creating tarball...
../phipinfoio.tgz
Calling installer...
[phantom@phantom phipinfoio] $
```

--------------------------------

### Splunk SOAR: Compile and Install App

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/tutorial-use-the-splunk-soar-cloud-app-wizard-to-develop-an-app-framework

This snippet demonstrates the command-line process for compiling and installing a Splunk SOAR app. It includes navigating to the app directory and executing the `phenv compile_app` command with the install flag.

```bash
[phantom@phantom ~]$ cd phipinfoio
[phantom@phantom phipinfoio]$ phenv compile_app -i
```

--------------------------------

### Install Splunk SOAR App from Splunkbase

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-cloud

This guide details how to install apps directly from Splunkbase. You can search for specific apps or install all available ones.

```bash
1. From the Home menu, select Apps.
2. Click New Apps.
3. Search for apps by typing search terms into the search bar at the top of the list of apps.
4. Select the app you want to install then click Install. If you want to install all available apps click Install All.
5. If you are prompted for your credentials, use your Splunk.com login information.
```

--------------------------------

### Splunk SOAR (Cloud) Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-splunk-soar-on-premises-playbooks-and-custom-functions-to-splunk-soar-cloud

A tutorial to guide users through developing playbooks using Python in Splunk SOAR (Cloud). It covers basic concepts and provides practical examples for creating automated security workflows.

```python
This tutorial provides step-by-step instructions and code examples for creating Python playbooks in Splunk SOAR (Cloud). It covers topics such as defining playbook logic, using built-in functions, and integrating with external systems.
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/add-an-action-block-to-your-splunk-soar-cloud-playbook

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/use-filters-in-your-splunk-soar-cloud-playbook-to-specify-a-subset-of-artifacts-before-further-processing

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/add-a-new-block-to-your-splunk-soar-cloud-playbook

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR (Cloud) Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/prerequisites-for-migrating-from-splunk-soar-on-premises-to-splunk-soar-cloud

A tutorial to guide users through developing playbooks using Python in Splunk SOAR (Cloud). It covers basic concepts and provides practical examples for creating automated security workflows.

```python
This tutorial provides step-by-step instructions and code examples for creating Python playbooks in Splunk SOAR (Cloud). It covers topics such as defining playbook logic, using built-in functions, and integrating with external systems.
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/repeat-actions-with-logic-loops

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/find-existing-playbooks-for-your-apps

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR (Cloud) Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-splunk-soar-on-premises-applications-to-splunk-soar-cloud

A tutorial to guide users through developing playbooks using Python in Splunk SOAR (Cloud). It covers basic concepts and provides practical examples for creating automated security workflows.

```python
This tutorial provides step-by-step instructions and code examples for creating Python playbooks in Splunk SOAR (Cloud). It covers topics such as defining playbook logic, using built-in functions, and integrating with external systems.
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/add-custom-code-to-your-splunk-soar-cloud-playbook-with-a-custom-function

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/specify-a-datapath-in-your-playbook

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/find-existing-playbooks

A tutorial guiding users through the process of building playbooks using Python in Splunk SOAR (Cloud). It covers practical examples and best practices for creating automated workflows.

```Python
# Tutorial example: Creating a simple playbook to process an IP address
from splunktauc.workflow import Workflow
from splunktauc.workflow.block import ActionBlock

def create_ip_processing_playbook():
    wf = Workflow()
    # Assume 'ip_address' is an artifact from a previous step
    ip_artifact = "{{container.artifacts[0].value}}"
    
    # Example: Use an existing action to get threat intel for the IP
    threat_intel_action = ActionBlock(action_id='virustotal_ip_intel', input_parameters={'ip': ip_artifact})
    wf.add_block(threat_intel_action)
    
    return wf.to_json()
```

--------------------------------

### Splunk SOAR (Cloud) Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/use-soar-cloud/get-started-using-splunk-soar-cloud/view-recommended-playbooks-actions-and-mission-experts-for-resolving-an-event

This tutorial guides users through the process of building and deploying custom playbooks using Python within Splunk SOAR (Cloud). It covers essential concepts, best practices, and practical examples for automating security workflows.

```Python
# Tutorial Example: Enriching an artifact with external data

from soar.api import get_artifact, create_note
import requests

def enrich_artifact(artifact_id):
    artifact = get_artifact(artifact_id=artifact_id)
    ip_address = artifact['value']
    
    try:
        response = requests.get(f"https://api.ipgeolocation.io/ipgeo?apiKey=YOUR_API_KEY&ip={ip_address}")
        data = response.json()
        country = data.get('country_name', 'N/A')
        create_note(artifact_id=artifact_id, note=f"IP Address Location: {country}")
    except Exception as e:
        create_note(artifact_id=artifact_id, note=f"Error enriching artifact: {e}")

    return "Enrichment complete"
```

--------------------------------

### Splunk SOAR Platform Installation for Python 3

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/python/update-python-version-in-apps

This guide explains how to perform the platform installation for Python 3 within the Splunk SOAR environment. It outlines the prerequisites and steps required to set up Python 3 for app development and execution.

```text
Platform installation for Python 3
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/python/update-python-version-in-apps

A step-by-step tutorial for developing playbooks in Splunk SOAR using Python. This guide covers essential concepts and practical examples to help users create effective automation workflows.

```text
Python Playbook Tutorial
```

--------------------------------

### Splunk SOAR (Cloud) Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/introduction-to-splunk-soar-cloud/administer-splunk-soar-cloud

This tutorial guides users through creating and deploying Python playbooks in Splunk SOAR (Cloud). It demonstrates practical examples of automating security tasks, such as enriching artifacts, creating incidents, and responding to threats. This resource is valuable for users looking to leverage the platform's automation capabilities.

```python
# Tutorial Example: Enriching IP Address Artifact

from spl_sdk.playbook import Playbook
from spl_sdk.artifact import Artifact

def main(playbook: Playbook):
    # Get an IP address artifact
    ip_artifact: Artifact = playbook.get_artifact_by_type('ip')

    if ip_artifact:
        ip_address = ip_artifact.value
        playbook.log(f"Enriching IP address: {ip_address}")

        # Example: Using a hypothetical threat intelligence lookup function
        # In a real scenario, this would call an external API or a SOAR App
        threat_info = lookup_ip_threat_intelligence(ip_address)

        if threat_info:
            playbook.add_note_to_artifact(ip_artifact.id, f"Threat Intel: {threat_info['status']} - {threat_info['description']}")
            playbook.set_artifact_label(ip_artifact.id, 'malicious')
        else:
            playbook.add_note_to_artifact(ip_artifact.id, "Threat intelligence lookup failed.")
    else:
        playbook.log("No IP address artifact found.")

def lookup_ip_threat_intelligence(ip: str) -> dict:
    # Placeholder for actual threat intelligence lookup
    # This function would typically interact with a SOAR App or external API
    if ip == "8.8.8.8":
        return {"status": "benign", "description": "Google Public DNS"}
    elif ip == "1.2.3.4":
        return {"status": "malicious", "description": "Known malicious IP"}
    else:
        return None
```

--------------------------------

### Install Splunk SOAR SDK Tools

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-sdk

This snippet details the commands to install the necessary tools for developing Splunk SOAR apps using the SDK. It includes installing Python versions and the Splunk SOAR SDK itself via the 'uv' package manager.

```bash
uv python install 3.9 3.13
uv tool install splunk-soar-sdk
```

--------------------------------

### Install Splunk SOAR App from Local File

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-cloud

This process describes how to install a new Splunk SOAR (Cloud) app by uploading its archive file. Ensure you have the app's .tar or .rpm file ready.

```bash
1. From the Home menu, select Apps.
2. Click Install App.
3. Drag and drop a .tar or .rpm archive of the app into the file field, or click in the file field and navigate to the location of the app file on your system.
4. Click Install.
```

--------------------------------

### Example Export Custom List URI

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/use-soar-cloud/get-started-using-splunk-soar-cloud/create-custom-lists-for-use-in-splunk-soar-cloud-playbooks

An example of the URI format for exporting a custom list, demonstrating how to substitute placeholders with actual server details, credentials, and list names.

```text
https://admin:password@SOAR_server.example.com/rest/decided_list/blockdomains/formatted_content?_output_format=csv
```

--------------------------------

### Splunk SOAR App Summary

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/splunk-soar-cloud-telemetry/share-data-from-splunk-soar-cloud

Provides a summary of apps installed on the system, including name, description, version, product name, and vendor. This helps in understanding the installed application ecosystem.

```JSON
{
  "type": "event",
  "component": "automation.summary.app_summary",
  "data": {
    "app_name": "MaxMind",
    "description": "This app provides IP geolocation with the included MaxMind database",
    "version": "2.2.5",
    "product_name": "GeoIP2",
    "product_vendor": "MaxMind",
    "soarDeploymentID": "soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9",
    "license": "community",
    "productVersion": "6.1.0.58",
    "missionControlDeploymentID": null,
    "cloudWorksEnvironment": "dev"
  },
  "deploymentID": "soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9",
  "optInRequired": 3,
  "version": null,
  "timestamp": 1685128654000,
  "visibility": [
    "anonymous"
  ]
}
```

--------------------------------

### Install Splunk SOAR SDK Tools

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps

This snippet details the commands to install the necessary tools for developing Splunk SOAR apps using the SDK. It includes installing Python versions and the Splunk SOAR SDK itself via the 'uv' package manager.

```bash
uv python install 3.9 3.13
uv tool install splunk-soar-sdk
```

--------------------------------

### Create App Installation TAR File

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/connector-module-development

Provides the command-line syntax for creating a compressed tar archive (`.tgz`) of an app's files, which is necessary for installation on the Splunk SOAR platform.

```bash
tar -zcvf samplewhois.tgz samplewhois
```

--------------------------------

### Get Apps with Phantom API

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/python-playbook-api-reference/automation-api/data-access-automation-api

Demonstrates how to use the phantom.get_apps() API to retrieve a list of installed applications. It shows examples of fetching all apps, filtering by action, asset, or app type.

```python
def on_start(container):
    apps=[]
    apps = phantom.get_apps()
    phantom.debug(apps)
    apps=phantom.get_apps(action='file reputation')
    phantom.debug(apps)
    apps = phantom.get_apps(asset='my_smtp_asset')
    phantom.debug(apps)
    apps = phantom.get_apps(app_type='information')
    phantom.debug(apps)
    return
```

--------------------------------

### Splunk SOAR (Cloud) Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/introduction-to-splunk-soar-cloud/take-a-tour-of-splunk-soar-cloud-and-perform-product-onboarding-when-you-log-in-for-the-first-time

This tutorial guides users through creating and implementing Python playbooks in Splunk SOAR (Cloud). It covers basic concepts, common use cases, and best practices for automation.

```Python
# Example of creating a new playbook
# playbook_name = "My First Playbook"
# playbook_description = "This playbook automates initial incident triage."

# Define playbook logic here
# def run_playbook(incident):
#     print(f"Running playbook for incident: {incident['id']}")
#     return {"status": "completed"}
```

--------------------------------

### Splunk SOAR Connector Output Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-templates/map-template

An example of data that a Splunk SOAR connector might return, including latitude, longitude, address, and description for a specific location.

```json
{
  "latitude": 37.4487,
  "longitude": -122.1181,
  "address": "1.2.3.4",
  "description": "A nice place to live"
}
```

--------------------------------

### Validate and Install Dependencies

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-product-settings-for-your-splunk-soar-cloud-instance/manage-automation-dependencies

This snippet shows the process of validating and installing all added automation dependencies in Splunk SOAR. This step ensures compatibility and proper installation of the packages.

```Splunk SOAR
1. After adding packages, select 'Validate and Install Splunk SOAR'.
2. Splunk SOAR will validate package compatibility.
3. Once validated, the modules will appear in the Automation dependencies table.
```

--------------------------------

### Get Apps with Phantom API

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/automation-api/data-access-automation-api

Demonstrates how to use the phantom.get_apps() API to retrieve a list of installed applications. It shows examples of fetching all apps, filtering by action, asset, or app type.

```python
def on_start(container):
    apps=[]
    apps = phantom.get_apps()
    phantom.debug(apps)
    apps=phantom.get_apps(action='file reputation')
    phantom.debug(apps)
    apps = phantom.get_apps(asset='my_smtp_asset')
    phantom.debug(apps)
    apps = phantom.get_apps(app_type='information')
    phantom.debug(apps)
    return
```

--------------------------------

### Install Python Packages with pip

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-splunk-soar-on-premises-applications-to-splunk-soar-cloud

This command is used to install Python packages. In Splunk SOAR (Cloud), dependencies must be specified in configuration JSON files rather than installed globally using this command.

```bash
phenv python pip install <package_name>
```

--------------------------------

### Splunk SOAR (Cloud) System Info Response Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/get-system-info

Example JSON response for the system_info endpoint, detailing the base URL and timezone of the Splunk SOAR (Cloud) instance.

```json
{ "base_url": "https://phantom.example.com", "time_zone": "UTC" }
```

--------------------------------

### Get Splunk SOAR Product Installation ID

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/app-authoring-api

Returns the unique identifier for the specific installation of Splunk SOAR (Cloud).

```python
get_product_installation_id()
```

--------------------------------

### Develop App with Splunk SOAR App Wizard (Tutorial)

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/use-datapaths-to-present-data-to-the-splunk-soar-cloud-web-interface

Follow this tutorial to develop an application framework using the Splunk SOAR (Cloud) App Wizard. The wizard simplifies the initial setup and structure of your custom applications.

```Bash
# Navigate to the Splunk SOAR App Wizard directory
# cd /path/to/splunk-soar-app-wizard

# Run the wizard to create a new app
# python wizard.py --create --app-name MyNewApp

# Follow the prompts to configure your app
# The wizard will generate the basic file structure and configuration files.
```

--------------------------------

### Splunk SOAR GET Search Response Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/search-endpoints/rest-search

Example of a successful JSON response from the Splunk SOAR Cloud REST API's GET /search endpoint. It includes the count of results, number of pages, and a list of matching results with their URLs, categories, and match details.

```json
{
  "count": 10,
  "num_pages": 1,
  "results": [
    {
      "url": "https://10.1.16.99/docs/app_reference/maxmind_c566e153-3118-4033-abda-14dd9748c91a",
      "category": "app",
      "verbose": "App",
      "match": { "message": "" }
    },
    {
      "url": "https://10.1.16.99/docs/rest/search",
      "category": "docs",
      "verbose": "Documentation",
      "match": { "message": "" }
    },
    {
      "url": "https://10.1.16.99/docs/automation/playbooks",
      "category": "docs",
      "verbose": "Documentation",
      "match": { "message": "" }
    },
    . . .
  ]
}
```

--------------------------------

### Install Splunk SOAR (Cloud) App via POST

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/app-endpoints/rest-app

Installs a Splunk SOAR (Cloud) app by sending a POST request with a base64 encoded tarball or installer package to the /rest/app endpoint. The response indicates success or failure.

```bash
curl -k -u username:password https://localhost/rest/app \
 -d '{ "app": "<BASE64 ENCODED TARBALL OR INSTALLER PACKAGE>" }'
```

--------------------------------

### Minimal Splunk SOAR Playbook Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/python-playbook-tutorial

A basic Splunk SOAR playbook demonstrating the on_start() function, artifact collection, and initiating an action with a callback. It shows how to collect IP addresses from artifacts and use the 'geolocate ip' action.

```Python
import phantom.rules as phantom
import json

# This function gets called for all new containers or when new artifacts # are added to an existing container.
def on_start(container):
    # container is a JSON object representing the object that this playbook # can automate on
    # use phantom.collect() API to get the artifacts that belong # to this container and call phantom.act().
    ips = set(phantom.collect(container, 'artifact:*.cef.sourceAddress'))
    parameters = []
    for ip in ips:
        parameters.append({
            "ip": ip
        })

    if parameters:
        # In phantom.act(), use the optional parameter 'callback' to get # called when the action completes
        my_test_ips = []
        my_test_ips.append('1.1.1.1')
        phantom.act('geolocate ip', parameters=parameters, assets=["maxmind"], handle=json.dumps(my_test_ips), callback=geolocate_ip_cb)
    return

# this is a callback function for the action.
# Evaluate the results and/or call other actions
def geolocate_ip_cb(action, success, container, results, handle):
    # # See the documentation for 'callback' for detailed information on # these parameters #
    if not success:
        return
    return

def on_finish(container, summary):
    # Summary is a user friendly representation of all action outcomes
    # call phantom.get_summary() to get a JSON representation of all # action results here
    return
```

--------------------------------

### Create Asset with App GUID

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/asset-endpoints/rest-asset

Example of creating a new asset using the `app_guid` for identification. This method is an alternative to using `app_id` when the GUID is known.

```bash
POST /rest/asset

argument_string: "app_guid=<app_guid>"

```

--------------------------------

### Splunk SOAR Search URL Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/use-soar-cloud/get-started-using-splunk-soar-cloud/search-within-splunk-soar-cloud

This example demonstrates how a search term is incorporated into the URL for bookmarking purposes in Splunk SOAR (Cloud).

```text
https://<Splunk SOAR URL>/search?query=events
```

--------------------------------

### Minimal Splunk SOAR Playbook Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/python-playbook-tutorial/playbook-api-tutorial/python-playbook-tutorial-for-splunk-soar-cloud-overview

A basic Splunk SOAR playbook demonstrating the on_start() function, artifact collection, and initiating an action with a callback. It shows how to collect IP addresses from artifacts and use the 'geolocate ip' action.

```Python
import phantom.rules as phantom
import json

# This function gets called for all new containers or when new artifacts # are added to an existing container.
def on_start(container):
    # container is a JSON object representing the object that this playbook # can automate on
    # use phantom.collect() API to get the artifacts that belong # to this container and call phantom.act().
    ips = set(phantom.collect(container, 'artifact:*.cef.sourceAddress'))
    parameters = []
    for ip in ips:
        parameters.append({
            "ip": ip
        })

    if parameters:
        # In phantom.act(), use the optional parameter 'callback' to get # called when the action completes
        my_test_ips = []
        my_test_ips.append('1.1.1.1')
        phantom.act('geolocate ip', parameters=parameters, assets=["maxmind"], handle=json.dumps(my_test_ips), callback=geolocate_ip_cb)
    return

# this is a callback function for the action.
# Evaluate the results and/or call other actions
def geolocate_ip_cb(action, success, container, results, handle):
    # # See the documentation for 'callback' for detailed information on # these parameters #
    if not success:
        return
    return

def on_finish(container, summary):
    # Summary is a user friendly representation of all action outcomes
    # call phantom.get_summary() to get a JSON representation of all # action results here
    return
```

--------------------------------

### Track Splunk Session Start with Browser and OS Details

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/splunk-soar-cloud-telemetry/share-data-from-splunk-soar-cloud

Reports the browser and operating system details, along with their versions, at the start of a session. This event helps in understanding the user's environment.

```JSON
{
  "app.session.session_start": {
    "data": {
      "app": "UNKNOWN_APP",
      "browser": "Chrome",
      "browserVersion": "78.0.3904.97",
      "device": "MacIntel",
      "locale": "en-US",
      "os": "Mac OS X",
      "osVersion": "10",
      "page": "UNKNOWN_PAGE",
      "splunkVersion": "not available"
    },
    "eventID": "d9ca862c-d48d-83a1-d1bb-f0f25f4b5af8",
    "experienceID": "6c2c534b-e750-e1a0-95fd-fcada1a50be0",
    "optInRequired": 3,
    "timestamp": 1574213029,
    "visibility": "anonymous"
  }
}
```

--------------------------------

### Get Indicator Timeline JSON Response - Splunk SOAR

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/indicator-endpoints/rest-indicators

Example JSON response for a successful GET request to retrieve indicator timeline data.

```json
{ "data": [ { "containerId": null, "count": 510, "didInjectThisDataPoint": true, "eventName": null, "id": null, "readableTime": "6/22", "severity": null, "time": "2018-06-22T19:00:11.430074Z", "type": "node", "unixTime": 1529694011.430074 }, { "count": 510, "nodeCount": 509, "nodeSeverityCount": { "high": 299, "low": 100, "medium": 110 }, "readableTime": "7/23", "time": "2018-07-23T03:59:59.363828Z", "type": "group", "unixTime": 1532318399.3638277 }, { "containerId": null, "count": 510, "didInjectThisDataPoint": true, "eventName": null, "id": null, "readableTime": "7/27", "severity": null, "time": "2018-07-27T04:59:47.569926Z", "type": "node", "unixTime": 1532667587.569926 } ], "domain": [ 1529884800, 1532476799 ] }
```

--------------------------------

### Develop Splunk SOAR App Framework with App Wizard

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/tutorial-use-the-splunk-soar-cloud-app-wizard-to-develop-an-app-framework

This tutorial guides users through developing an app framework for Splunk SOAR (Cloud) using the App Wizard. The framework includes sample code for interacting with external services and the Splunk SOAR platform.

```Python
def __init__(self, helper):
    self.helper = helper

def test_connection(self):
    # Code to test connection to external service
    pass

def execute_action(self, action, parameters):
    # Code to execute a specific action
    pass

def get_progress_message(self, message):
    # Code to send progress messages to Splunk SOAR
    pass

def return_action_results(self, results):
    # Code to return action results to Splunk SOAR
    pass
```

--------------------------------

### Get Containers by Indicator JSON Response - Splunk SOAR

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/indicator-endpoints/rest-indicators

Example JSON response for a successful GET request to retrieve containers associated with indicator IDs.

```json
[ { "container_id": 81, "container_name": "koov4rra2ree5p6fzt1bcnjusu" }, { "container_id": 61, "container_name": "6r8cm1798gq5hrb8e8t3ujw01m" } ]
```

--------------------------------

### Get Splunk SOAR Automation Broker Information

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/automation-broker-endpoints/rest-automation-broker

Retrieves information about installed and launched Automation Brokers. This GET request to the /rest/automation_proxy endpoint returns a list of brokers and their settings.

```bash
curl -X GET -u 'https://<username>:<password>@<instance_name>.splunkcloud.com/rest/automation_proxy/rest/automation_proxy'
```

--------------------------------

### Splunk SOAR (Cloud) License Response Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/get-system-info

Example JSON response for the license endpoint, showing status, license details (like issue date, expiration date, license type), and current usage metrics.

```json
{ "status": "valid", "license_info": { "case_management": true, "issue_date": 1490227200000, "maximum_apps": 0, "expiration_date": 1521763200000, "maximum_users": 0, "contact_information": "soc@example.com", "company_name": "example", "maximum_assets": 0, "license_number": "6bcff42b-4988-4951-9efa-371364102b11", "license_type": "standard", "maximum_actions_per_day": 0, "maximum_containers": 0 }, "current_usage": { "recent_playbook_run_count": 40, "recent_app_run_count": 60, "recent_debug_run_count": 60 } }
```

--------------------------------

### Get User Settings List (curl)

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/user-settings-endpoints/rest-user-settings

Retrieves a list of user settings for a specified user. This example uses curl to send a GET request to the Splunk SOAR API endpoint.

```curl
curl -k -u soar_local_admin:changeme https://localhost/rest/user_settings -G -X GET
```

--------------------------------

### Example Playbook GET Response

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/playbook-endpoints/rest-playbook

A sample JSON response structure for a successful GET request to retrieve playbook details. It includes fields like ID, active status, trigger, and tags.

```json
{ "tags": [ ], "id": 123, "active": false, "playbook_trigger": "artifact_created", "blockly": false, ... }
```

--------------------------------

### Get All Audit Events for a Specific Object Type (e.g., Playbook)

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/audit-endpoints/rest-audit

Retrieves all audit events for a specified object type by using a wildcard character '*'. This example shows how to get all playbook audit events.

```bash
curl -k -u username:password https://localhost/rest/audit?playbook=* -G -X GET
```

--------------------------------

### Splunk SOAR (Cloud) REST API Reference

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/introduction-to-splunk-soar-cloud/take-a-tour-of-splunk-soar-cloud-and-perform-product-onboarding-when-you-log-in-for-the-first-time

This section details the REST API endpoints available for interacting with Splunk SOAR (Cloud). It covers authentication, available resources, request methods, and response formats for programmatic access.

```bash
curl -X GET \
  'https://your_splunk_soar_instance.com/api/v1/incidents' \
  -H 'Authorization: Bearer YOUR_API_TOKEN' \
  -H 'Content-Type: application/json'
```

--------------------------------

### Splunk SOAR GET Search Query Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/search-endpoints/rest-search

Example of how to perform a search query using curl against the Splunk SOAR Cloud REST API. This request searches for 'maxmind' within the 'app' and 'docs' categories.

```curl
curl -k -u username:password https://localhost/rest/search?query=maxmind&categories=app,docs -G -X GET
```

--------------------------------

### Get System Settings Status (curl)

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/system-settings-endpoints/rest-system-settings

Retrieves the status of system settings, such as mobile settings, using a GET request to the Splunk SOAR Cloud REST API. This example demonstrates how to specify the 'sections' query parameter to filter the results.

```curl
curl -k -u username:password https://localhost/rest/system_settings?sections=["mobile"] -G -X GET
```

--------------------------------

### Get Splunk SOAR Container Labels

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/system-settings-endpoints/rest-system-settings

Retrieves a list of container labels setup information from Splunk SOAR (Cloud) using the /rest/system_settings/labels API.

```json
{ "events", "test_label" }
```

--------------------------------

### Minimal Splunk SOAR Playbook Example

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-tutorial/playbook-api-tutorial/python-playbook-tutorial-for-splunk-soar-cloud-overview

A basic Splunk SOAR playbook demonstrating the on_start() function, artifact collection, and initiating an action with a callback. It shows how to collect IP addresses from artifacts and use the 'geolocate ip' action.

```Python
import phantom.rules as phantom
import json

# This function gets called for all new containers or when new artifacts # are added to an existing container.
def on_start(container):
    # container is a JSON object representing the object that this playbook # can automate on
    # use phantom.collect() API to get the artifacts that belong # to this container and call phantom.act().
    ips = set(phantom.collect(container, 'artifact:*.cef.sourceAddress'))
    parameters = []
    for ip in ips:
        parameters.append({
            "ip": ip
        })

    if parameters:
        # In phantom.act(), use the optional parameter 'callback' to get # called when the action completes
        my_test_ips = []
        my_test_ips.append('1.1.1.1')
        phantom.act('geolocate ip', parameters=parameters, assets=["maxmind"], handle=json.dumps(my_test_ips), callback=geolocate_ip_cb)
    return

# this is a callback function for the action.
# Evaluate the results and/or call other actions
def geolocate_ip_cb(action, success, container, results, handle):
    # # See the documentation for 'callback' for detailed information on # these parameters #
    if not success:
        return
    return

def on_finish(container, summary):
    # Summary is a user friendly representation of all action outcomes
    # call phantom.get_summary() to get a JSON representation of all # action results here
    return
```

--------------------------------

### Install Splunk SOAR Apps and Get Python Version via REST API

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/app-endpoints/rest-app

This snippet demonstrates how to interact with the Splunk SOAR (Cloud) REST API to install applications and retrieve information about their Python versions. The /rest/app endpoint is used for this purpose. Ensure the authenticated user has the necessary permissions to edit Apps.

```REST
https://<username>:<password>@<host>/rest/app
```

--------------------------------

### Install Splunk SOAR (Cloud) App via Python

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/app-endpoints/rest-app

Provides a Python script to install a Splunk SOAR (Cloud) app. It reads the app file, base64 encodes it, and sends it in a POST request to the /rest/app endpoint.

```python
import json
import base64
import requests

file_contents = open('/path/to/myapp.tgz', 'rb').read()
encoded_contents = base64.b64encode(file_contents)
payload = {'app': encoded_contents}

requests.post('https://phantom.mycompany.com/rest/app', auth=('soar_local_admin', PASSWORD), data=json.dumps(payload))
```

--------------------------------

### Get Assets with Phantom API

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/python-playbook-api-reference/automation-api/data-access-automation-api

Illustrates the usage of the phantom.get_assets() API to fetch configured assets in Splunk SOAR Cloud. Examples include filtering assets by action, tags, and types.

```python
def on_start(container):
    assets = phantom.get_assets(action='file reputation')
    phantom.debug(assets)
    assets = phantom.get_assets(tags=['my_tag'])
    phantom.debug(assets)
    assets = phantom.get_assets(types=['reputation service'])
    return
```

--------------------------------

### Splunk SOAR (Cloud) Python Playbook API Reference

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/introduction-to-splunk-soar-cloud/take-a-tour-of-splunk-soar-cloud-and-perform-product-onboarding-when-you-log-in-for-the-first-time

This section provides API reference documentation for developing playbooks using Python within Splunk SOAR (Cloud). It details the available functions, methods, and classes for automating security workflows.

```Python
from soar.api import get_incident, add_note, assign_user

def playbook_example(incident_id):
    incident = get_incident(incident_id)
    note_text = f"Processing incident {incident_id}"
    add_note(incident_id, note_text)
    assign_user(incident_id, "analyst@example.com")
    return {"status": "success"}
```

--------------------------------

### Initialize Base URL in Python

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/develop-apps/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/tutorial-use-the-splunk-soar-cloud-app-wizard-to-develop-an-app-framework

Demonstrates the `initialize` function, which is called before each action run. It shows how to load state, retrieve configuration values like `base_url`, and set internal variables.

```Python
def initialize(self):
    # Load the state in initialize, use it to store data
    # that needs to be accessed across actions
    self._state = self.load_state()
    # get the asset config
    config = self.get_config()
    # Access values in asset config by the name
    # Required values can be accessed directly
    self._base_url = config['base_url']
    return phantom.APP_SUCCESS
```

--------------------------------

### Get Assets with Phantom API

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/automation-api/data-access-automation-api

Illustrates the usage of the phantom.get_assets() API to fetch configured assets in Splunk SOAR Cloud. Examples include filtering assets by action, tags, and types.

```python
def on_start(container):
    assets = phantom.get_assets(action='file reputation')
    phantom.debug(assets)
    assets = phantom.get_assets(tags=['my_tag'])
    phantom.debug(assets)
    assets = phantom.get_assets(types=['reputation service'])
    return
```

--------------------------------

### Get Finding or Investigation

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/automate-responses-with-splunk-enterprise-security-playbook-blocks

Retrieves a finding or an entire investigation by its GUID or display ID from Splunk Enterprise Security, without needing to run a search. This is efficient for direct data retrieval.

```python
playbook.get_finding_or_investigation(identifier)
```

--------------------------------

### Splunk SOAR Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/create-a-new-playbook-in-splunk-soar-cloud

Follow this tutorial to learn the basics of building playbooks in Splunk SOAR (Cloud), covering essential steps and concepts for automating workflows.

```python
# Example of a simple playbook step
print("Starting playbook execution...")

# Simulate an action
action_result = {"status": "success", "data": "processed_data"}

if action_result["status"] == "success":
    print("Action completed successfully.")
else:
    print("Action failed.")
```

--------------------------------

### Get Splunk SOAR Telemetry Publish Time

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/splunk-soar-cloud-telemetry/share-data-from-splunk-soar-cloud

Records the start time, end time, and total duration of the telemetry publish job. This helps in monitoring the performance of data publishing operations.

```python
{
  'type': 'event',
  'component': 'automation.summary.publish_telemetry_time_taken',
  'data': {
    'start_time': 28244.781,
    'end_time': 28244.812,
    'total_time': 0.031,
    'soarDeploymentID': 'soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',
    'license': 'community',
    'productVersion': '6.1.0.58',
    'missionControlDeploymentID': None,
    'cloudWorksEnvironment': 'dev'
  },
  'deploymentID': 'soar-e25f2b02-b4c3-43ae-a40c-acf2e0a936a9',
  'optInRequired': 3,
  'version': None,
  'timestamp': 1685128654000,
  'visibility': [
    'anonymous'
  ],
  'indexData': True,
  'begin': None,
  'end': None
}
```

--------------------------------

### Get Tenants List with Pagination - cURL

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/multi-tenancy-endpoints/rest-tenant

Retrieves a list of all configured tenants in Splunk SOAR Cloud using the REST API. This example demonstrates how to use curl with pagination parameters (page_size and page).

```bash
curl -k -u soar_local_admin:changeme https://localhost/rest/note?page_size=5&page=0 -G -X GET
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/threat-intelligence-with-cisco-talos/harness-cisco-talos-intelligence-in-splunk-soar-cloud

A tutorial for developing playbooks in Splunk SOAR (Cloud) using Python. It guides users through creating and managing playbooks to automate analyst workflows.

```python
# Example playbook logic
def on_start(container):
    # Your playbook logic here
    pass

def on_finish(container, summary):
    # Your playbook logic here
    pass
```

--------------------------------

### Splunk SOAR Python Playbook Tutorial

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/build-playbooks/use-the-playbook-editor-to-create-and-view-playbooks-to-automate-analyst-workflows/use-keyboard-shortcuts-in-the-playbook-editor

Follow this tutorial to learn the fundamentals of building playbooks in Splunk SOAR (Cloud) using Python. It covers creating, testing, and deploying playbooks to automate security workflows.

```python
# Tutorial example: Creating a simple playbook
from spl_sdk import Playbook

def main(container):
    print(f"Processing container: {container['id']}")
    return {'status': 'processed'}
```

--------------------------------

### Onboard Splunk Cloud Platform/ES Data to Splunk SOAR

Source: https://help.splunk.com/en/splunk-soar/soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/migrate-from-splunk-soar-on-premises-to-splunk-soar-cloud/onboard-splunk-cloud-platform-or-splunk-enterprise-security-data

This section describes the process of onboarding Splunk Cloud Platform alerts, notables, or event forwarding into Splunk SOAR. The configuration is stated to be the same as for Splunk SOAR (On-premises). It directs users to the Splunk App for SOAR Export documentation for detailed steps and advises performing end-to-end testing before decommissioning any production environments.

```text
Onboarding Splunk Cloud Platform alerts, notables, or event forwarding can be configured in the same way as Splunk SOAR (On-premises). See the Splunk App for SOAR Export documentation. 
Note: Be sure to perform end to end testing prior to decommissioning your existing production environment.
```
Tokens:
Raw