Splunk SOAR

https://help.splunk.com/en/splunk-soar/soar-on-premises
Admin
Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) platform that combines...
Tokens:654,820
Snippets:4,012
Trust Score:10
Update:7 months ago
Show doc for...
Tokens:
Raw
### ibackup setup command output example

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.4.0/backup-or-restore-your-splunk-soar-on-premises-instance/back-up-a-splunk-soar-on-premises-deployment

This is an example of the output you might see when running the `ibackup --setup` command. It indicates the log file location, expected connection errors during bootstrapping, and prompts for confirmation to proceed with the setup. Successful completion is noted at the end.

```text
[phantom@phantom bin]$ phenv ibackup --setup
Logs for this script run will be located at /opt/phantom/var/log/phantom/ibackup/ibackup_2022-02-17-22-45-24.log
Attempting to connect to Postgresql, connection errors are expected while bootstrapping ...
Setup will temporarily stop phantom
If you wish to continue, enter yes to proceed: yes
Setup complete
Logs for this script run will be located at /opt/phantom/var/log/phantom/ibackup/ibackup_2022-02-17-22-45-24.log
```

--------------------------------

### Enable firewalld service to start on boot

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/install-splunk-soar-on-premises

This command configures the firewalld service to start automatically every time the system boots up. This ensures that the firewall is active from the moment the system starts, enhancing security.

```bash
sudo systemctl enable firewalld
```

--------------------------------

### Install Splunk SOAR App using REST API (Python)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/app-endpoints/rest-app

Provides a Python example for installing a Splunk SOAR (On-premises) app. It demonstrates reading an app file, base64 encoding its contents, and sending it as a JSON payload in a POST request to the /rest/app endpoint. The account used must have permissions to edit Apps.

```python
import json
import base64
import requests
file_contents = open('/path/to/myapp.tgz', 'rb').read()
encoded_contents = base64.b64encode(file_contents)
payload = {'app': encoded_contents}
requests.post('https://phantom.mycompany.com/rest/app',
                auth=('soar_local_admin', PASSWORD),
                data=json.dumps(payload))
```

--------------------------------

### Securely Copy Installer File

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/install-splunk-soar-on-premises

Copies the Splunk SOAR (On-premises) installer file from a local machine to the installation server using SCP. This command requires the path to the installer file, the username on the destination server, and the installation address of the server. Ensure SSH access is configured.

```bash
scp -r ./splunk_soar-unpriv-<version>.tgz <user>@<installation_address>
```

--------------------------------

### Start firewalld service

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/install-splunk-soar-on-premises

This command starts the firewalld service. It is used after installing firewalld or if the service has been stopped. This ensures the firewall is active and protecting the system.

```bash
sudo systemctl start firewalld
```

--------------------------------

### Example: Convert a Specific Classic Playbook (CLI)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/build-playbooks/8.4.0/introduction-to-splunk-soar-on-premises-playbooks/convert-classic-playbooks-to-modern-playbooks

This example demonstrates converting a specific classic playbook named 'classic_pb' located in the 'local' repository to the modern format, with '_modern' appended to the new playbook's name. The converted playbook will be placed in the 'local' repository.

```bash
phenv classic_to_modern local/classic_pb local -s "_modern"
```

--------------------------------

### GET /rest/system_settings/labels

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/system-settings-endpoints/rest-system-settings

Return a list of container labels setup information from label settings.

```APIDOC
## GET /rest/system_settings/labels

### Description
Return a list of container labels setup information from label settings in Splunk SOAR (On-premises).

### Method
GET

### Endpoint
/rest/system_settings/labels

### Response
#### Success Response (200)
- The response is a JSON object containing a list of labels.

#### Response Example
```json
{
    "events",
    "test_label"
}
```
```

--------------------------------

### Prepare System for Incremental Restore

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.4.0/backup-or-restore-your-splunk-soar-on-premises-instance/restore-splunk-soar-on-premises-from-a-backup

Execute the `phenv ibackup --setup` command to prepare the Splunk SOAR (On-premises) system for an incremental backup restore. This command must be run before copying backup files.

```shell
phenv ibackup --setup
```

--------------------------------

### Install from Wheel File (Python 2)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/app-structure/configure-metadata-in-a-json-schema-to-define-your-apps-configuration

Installs Python 2 dependencies using local wheel files, bypassing direct internet connectivity. The `module` and `input_file` path are required.

```json
{
   "pip_dependencies": {
      "wheel": [
         {"module": "python-rtkit", "input_file": "wheels/python_rtkit-0.7.0-py27-none-any.whl"}
      ]
   }
}
```

--------------------------------

### GET Prompt Details - JSON Response

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/approval-endpoints/rest-approval

Example JSON response for a successful GET request to retrieve prompt details. This response includes information about the playbook, container, action, and notification targets for a prompt.

```json
{
    "playbook_repo": "local",
    "update_time": "2019-08-19T21:58:03.846035Z",
    "playbook_name": "pb-prompt",
    "container_id": 292,
    "time_left": 1758.571971,
    "next_owner": null,
    "action_name": "prompt_1",
    "due_time": "2019-08-19T22:28:03.817000Z",
    "asset": null,
    "action_type": "prompt",
    "container_name": "Testcases.000100-Rest.000230-Custom Status.000200-Custom Status Severity Generator",
    "owner": "username",
    "notification_type": "prompts",
    "type": "manual",
    "notification_targets": [{
        "app_id": 0,
        "parameters": [{
            "to": "root@localhost",
            "message": "test",
            "mins_to_act": 30,
            "user_ids": [
                1
            ],
            "response_types": [{
                "prompt": "",
                "options": {
                    "type": "message"
                }
            }]
        }],
        "assets": []
    }]
}
```

--------------------------------

### Splunk SOAR Action Execution and Callback

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/python-playbook-api-reference/8.4.0/automation-api

Demonstrates how to execute an action, in this case, a 'prompt' action, within a Splunk SOAR playbook. It includes details on specifying parameters, assets, and a callback function to handle the action's results. The example shows a manual action completed by a user and the subsequent callback execution.

```json
{
    "asset_id": 0,
    "status": "success",
    "name": "prompt_to_block_ips",
    "app": "",
    "action_results": [
        {
            "status": "success",
            "data": [
                {
                    "response": "maybe"
                }
            ],
            "message": "proceed with blocking these ips on FW?",
            "parameter": {
                "message": "proceed with blocking these ips on FW?"
            },
            "summary": {
                "response": "maybe"
            }
        }
    ],
    "app_id": 0,
    "app_run_id": 0,
    "asset": "",
    "action": "prompt",
    "message": "1 action succeeded",
    "summary": {},
    "action_run_id": 57
}
```

--------------------------------

### Enable and Start PostgreSQL Service

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/run-splunk-soar-on-premises-using-external-services

Configures the PostgreSQL service to start automatically on system boot and then starts the service. This ensures the database is running and accessible.

```bash
systemctl enable postgresql-15
systemctl start postgresql-15
```

--------------------------------

### Start pgbouncer on Instance A - Splunk SOAR

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.4.0/create-and-manage-a-warm-standby/recreate-warm-standby-after-a-failover

Start the pgbouncer service on Instance A. This service is essential for managing database connections in the warm standby setup.

```bash
/<PHANTOM_HOME>/bin/phsvc start pgbouncer
```

--------------------------------

### Enable and start firewalld (Bash)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/upgrade-splunk-soar-on-premises/convert-a-privileged-splunk-soar-on-premises-deployment-to-an-unprivileged-deployment

These commands are used conditionally if firewalld is not active. 'enable' ensures it starts on boot, and 'start' activates it immediately. This is crucial for network accessibility of Splunk SOAR.

```bash
sudo systemctl enable firewalld
```

```bash
sudo systemctl start firewalld
```

--------------------------------

### GET /rest/system_settings/labels

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/system-settings-endpoints

Retrieve a list of container labels setup information from label settings in Splunk SOAR (On-premises).

```APIDOC
## GET /rest/system_settings/labels

### Description
Retrieve a list of container labels setup information from label settings in Splunk SOAR (On-premises).

### Method
GET

### Endpoint
/rest/system_settings/labels

### Response
#### Success Response (200)
- Returns a JSON object containing a list of labels.

#### Response Example
```json
{
    "events",
    "test_label"
}
```
```

--------------------------------

### Navigate to Setup Directory

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.4.0/backup-or-restore-your-splunk-soar-on-premises-instance/back-up-a-splunk-soar-on-premises-deployment

Change the current directory to the 'setup' directory that was created after extracting the 'db_bootstrap.tgz' file. This directory contains the database preparation script.

```shell
cd setup
```

--------------------------------

### Retrieve Container Labels Setup Information (REST API)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/system-settings-endpoints/rest-system-settings

This API retrieves a list of container labels setup information from the label settings in Splunk SOAR (On-premises). It is a GET request and does not require any specific parameters in the request body.

```json
{ "events", "test_label" }
```

--------------------------------

### Prepare Splunk SOAR for backup using ibackup

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.4.0/backup-or-restore-your-splunk-soar-on-premises-instance/back-up-a-splunk-soar-on-premises-deployment

This command prepares your Splunk SOAR (On-premises) deployment for backups by running the `ibackup` tool with the `--setup` option. This step is crucial after upgrades and temporarily stops services to configure the PostgreSQL database. Ensure you have sufficient disk space and have completed any necessary Warm Standby configurations beforehand.

```bash
/opt/phantom/bin/phenv ibackup --setup
```

--------------------------------

### Get User Settings with cURL

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/user-settings-endpoints

This example demonstrates how to retrieve a list of user settings using the cURL command-line tool. It includes authentication and specifies the GET request method.

```Shell
curl -k -u soar_local_admin:changeme https://localhost/rest/user_settings -G -X GET
```

--------------------------------

### Minimal Splunk SOAR Playbook Structure (Python)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/python-playbook-tutorial/8.4.0/playbook-api-tutorial/python-playbook-tutorial-for-splunk-soar-on-premises-overview

Demonstrates the basic structure of a Splunk SOAR playbook using Python. It includes the mandatory on_start() and on_finish() functions and an example of using phantom.act() to perform an action with a callback. This snippet requires the 'phantom' and 'json' libraries.

```python
import phantom.rules as phantom
import json

# This function gets called for all new containers or when new artifacts
# are added to an existing container.
def on_start(container):

    # container is a JSON object representing the object that this playbook
    # can automate on

    # use phantom.collect() API to get the artifacts that belong
    # to this container and call phantom.act().

    ips = set(phantom.collect(container, 'artifact:*.cef.sourceAddress'))
    parameters = []
    for ip in ips:
        parameters.append({ "ip" : ip })

    if parameters:
        # In phantom.act(), use the optional parameter 'callback' to get
        # called when the action completes
        my_test_ips = []
        my_test_ips.append('1.1.1.1')
        phantom.act('geolocate ip',
                    parameters=parameters,
                    assets=["maxmind"],
                    handle=json.dumps(my_test_ips),
                    callback=geolocate_ip_cb)
    return

# this is a callback function for the action.
def geolocate_ip_cb(action, success, container, results, handle):
    # # See the documentation for 'callback' for detailed information on #
    # these parameters #
    if not success:
        return
    return

def on_finish(container, summary):
    # Summary is a user friendly representation of all action outcomes
    # call phantom.get_summary() to get a JSON representation of all
    # action results here
    return

```

--------------------------------

### Get Indicator Response (JSON)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/indicator-endpoints

Example JSON response for a successful GET request for multiple indicators. Includes count, pagination details, and a list of indicator objects with their associated data.

```json
{ "count": 0, "data": [], "num_pages": 0 }
```

```json
{
    "count": 182,
    "data": [
        {
            "_special_labels": [
                "events"
            ],
            "total_events": 1,
            "_pretty_tenant": "_default_",
            "tags": [],
            "_special_fields": [
                "fileHash"
            ],
            "value": "00b3199ed932f084f50b6a4df9124132",
            "_pretty_latest_time": "0 minutes ago",
            "latest_time": "2019-05-07T19:09:29.778556Z",
            "_pretty_earliest_time": "0 minutes ago",
            "open_events": 1,
            "_special_contains": [
                "hash"
            ],
            "severity_counts": [
                {
                    "count": 1,
                    "name": "high"
                }
            ],
            "earliest_time": "2019-05-07T19:09:29.778556Z",
            "id": 323,
            "tenant": 0
        }
    ],
    "num_pages": 182
}
```

--------------------------------

### Prepare System for Splunk SOAR Installation

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/install-splunk-soar-on-premises

Executes the script to prepare the system for an unprivileged Splunk SOAR (On-premises) installation. It allows specifying the home directory and HTTPS port. Arguments are optional, and the script will prompt for configuration if not provided. Requires root or sudo privileges.

```bash
sudo ./soar-prepare-system --splunk-soar-home <home_directory> --https-port <port_number>
```

--------------------------------

### GET Evidence for Container (JSON Response)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/evidence-endpoints/rest-evidence

Example JSON response for a successful GET request to retrieve evidence for a specific container. The response includes pagination details and a list of evidence objects with their properties.

```JSON
{
    "count": 1,
    "data": [
        {
            "container": 5,
            "modified_time": "2019-05-23T17:18:39.595829Z",
            "_special_content_type": "artifact",
            "create_time": "2019-05-23T17:18:39.595528Z",
            "object_id": 20,
            "content_type": 52,
            "id": 1
        }
    ],
    "num_pages": 1
}
```

--------------------------------

### GET Note Attachments as Evidence (JSON Response)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/evidence-endpoints/rest-evidence

Example JSON response for a successful GET request to retrieve note attachments marked as evidence. It includes details like count, number of pages, and the data array with evidence information.

```JSON
{
    "count": 1,
    "num_pages": 1,
    "data": [
        {
            "id": 1,
            "create_time": "2023-02-16T19:40:23.450331Z",
            "modified_time": "2023-02-16T19:40:23.450905Z",
            "container": 1,
            "object_id": 2,
            "content_type": 90
        }
    ]
}
```

--------------------------------

### Minimal Splunk SOAR Python Playbook Example

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/python-playbook-tutorial/7.0

This Python script demonstrates a minimal Splunk SOAR playbook. It includes the required `on_start()` and `on_finish()` functions and utilizes `phantom.collect()` to gather artifacts and `phantom.act()` to execute an action ('geolocate ip') with a callback function (`geolocate_ip_cb`). The `on_start` function is triggered for new containers or artifacts, and the callback handles the action's completion.

```python
import phantom.rules as phantom
import json

# This function gets called for all new containers or when new artifacts
# are added to an existing container.
def on_start(container):

    # container is a JSON object representing the object that this playbook
    # can automate on

    # use phantom.collect() API to get the artifacts that belong
    # to this container and call phantom.act().

    ips = set(phantom.collect(container, 'artifact:*.cef.sourceAddress'))
    parameters = []
    for ip in ips:
        parameters.append({ "ip" : ip })

    if parameters:
        # In phantom.act(), use the optional parameter 'callback' to get
        # called when the action completes
        my_test_ips = []
        my_test_ips.append('1.1.1.1')
        phantom.act('geolocate ip',
                    parameters=parameters,
                    assets=["maxmind"],
                    handle=json.dumps(my_test_ips),
                    callback=geolocate_ip_cb)
    return

# this is a callback function for the action.
def geolocate_ip_cb(action, success, container, results, handle):
    # # See the documentation for 'callback' for detailed information on #
    # these parameters #
    if not success:
        return
    return

def on_finish(container, summary):
    # Summary is a user friendly representation of all action outcomes
    # call phantom.get_summary() to get a JSON representation of all
    # action results here
    return
```

--------------------------------

### Run make_cluster_node.pyc for Initial Node Setup

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/build-a-splunk-soar-on-premises-cluster/create-a-splunk-soar-on-premises-cluster-in-amazon-web-services

Executes the `make_cluster_node.pyc` script with the `--record` argument on the first Splunk SOAR (On-premises) instance. This action records the necessary configuration details into a `response.json` file, which will be used for subsequent node conversions. Ensure you are logged in as the 'phantom' user via SSH.

```python
phenv python <PHANTOM_HOME>/bin/make_cluster_node.pyc --record
```

--------------------------------

### Get Automation Broker Information (REST API)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/automation-broker-endpoints/rest-automation-broker

Retrieves information about installed and launched Automation Brokers. This GET request to the /rest/automation_proxy endpoint requires no specific arguments and returns a list of brokers. Permissions required: View System Settings.

```shell
curl -X GET -u 'https://<username>:<password>@<instance_name>.splunkcloud.com/rest/automation_proxy/rest/automation_proxy'
```

--------------------------------

### Sample Playbook Usage

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/python-playbook-api-reference/8.4.0/automation-api/playbook-automation-api

Example of how to use the phantom.prompt() function within a Splunk SOAR playbook, including defining a callback function to process the response.

```APIDOC
## Playbook Example: Prompting for IP Blocking

### Description
This playbook demonstrates calling `phantom.prompt()` to ask a user for confirmation before blocking IPs on a firewall. It defines a callback function `prompt_cb` to handle the user's response.

### Method
N/A (This is a playbook script example)

### Endpoint
N/A

### Parameters
(See `phantom.prompt()` documentation for parameter details)

### Request Example
```python
import phantom.rules as phantom
import json

def on_start(container):
    phantom.prompt(
        container=container,
        user="user@company.com",
        message="proceed with blocking these ips on FW?",
        respond_in_mins=10,
        callback=prompt_cb,
        options={
            'type': 'list',
            'choices': ['yes', 'no', 'maybe']
        },
        name="prompt_to_block_ips"
    )
    return

def prompt_cb(action, success, container, results, handle):
    phantom.debug(f"Prompt response: {results}")
    if success and results.get('response') == 'yes':
        # Add logic here to block IPs
        phantom.debug("User approved IP blocking.")
    elif success and results.get('response') == 'no':
        phantom.debug("User rejected IP blocking.")
    else:
        phantom.debug("Prompt timed out or user selected 'maybe'.")
    return

def on_finish(container, summary):
    return
```

### Response
(The response is handled within the `prompt_cb` function based on user input.)

### Error Handling
- Errors during prompt execution or callback processing should be handled within the playbook logic.
```

--------------------------------

### GET /api/apps

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/python-playbook-api-reference/8.4.0/automation-api/data-access-automation-api

Retrieves a flat listing of all installed apps and actions on the system. This API can be filtered by action, asset, or app type. It is not supported for use within custom functions.

```APIDOC
## GET /api/apps

### Description
Use the get_apps API to enumerate all of the apps installed on the system for each of the actions. The API returns a flat listing of all actions and apps with matching criteria. The get_apps API is not supported from within a custom function.

### Method
GET

### Endpoint
/api/apps

### Parameters
#### Query Parameters
- **action** (string) - Optional - The name of the action. Use this parameter to retrieve information about assets that support the action. For example, name the action something like "block_ip" when you retrieve information about assets that support the block IP action.
- **asset** (string) - Optional - The asset name that allows users to retrieve only those apps that match the specified asset.
- **app_type** (string) - Optional - This allows users to retrieve only apps that match the specified type of the app.

### Request Example
```python
apps = phantom.get_apps()
apps = phantom.get_apps(action='file reputation')
apps = phantom.get_apps(asset='my_smtp_asset')
apps = phantom.get_apps(app_type='information')
```

### Response
#### Success Response (200)
- **asset_disabled** (boolean) - Indicates if the asset is disabled.
- **product_version_match** (boolean) - Indicates if the product version matches.
- **app_type** (string) - The type of the app.
- **product_vendor** (string) - The vendor of the product.
- **product_name** (string) - The name of the product.
- **app_match_product_version** (string) - The product version matching pattern.
- **asset_name** (string) - The name of the asset.
- **ap_name** (string) - The name of the app.
- **action** (string) - The action supported by the app.
- **app_version** (string) - The version of the app.
- **asset_product_version** (string) - The product version of the asset.
- **asset_type** (string) - The type of the asset.

#### Response Example
```json
[
  {
    "asset_disabled": false,
    "product_version_match": true,
    "app_type": "sandbox",
    "product_vendor": "Cuckoo",
    "product_name": "Cuckoo",
    "app_match_product_version": ".*",
    "asset_name": "cuckoo",
    "ap_name": "Cuckoo",
    "action": "detonate file",
    "app_version": "1.2.8",
    "asset_product_version": "",
    "asset_type": "sandbox"
  }
]
```
```

--------------------------------

### Sample Output for Setting Splunk Index Prefix

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.4.0/configure-administration-settings-in-splunk-soar-on-premises/customize-your-forwarder-configuration

This is sample output from running the `set_preference` command in a Splunk SOAR (On-premises) unprivileged cluster with a distributed Splunk Enterprise deployment. It shows the confirmation prompt, the process of storing index configuration, and a list of next steps required on both Splunk SOAR and Splunk Enterprise/Cloud.

```bash
[phanru@phantom ~]$ phenv python -m manage set_preference --splunk-index-prefix prefix1 --splunk-admin-username admin Are you sure you wish to apply search index prefix prefix1 for this Phantom instance [yes/no]? yes
Proceeding ... index configuration stored: /home/phanru/phantomcyber/tmp/indexes.conf
Done! Next steps:
- indexes.conf must be updated via splunk cluster manager node.
- On Splunk Cloud Platform or Splunk Enterprise, edit permissions to allow the current or new HEC token to access new indexes.
- On Splunk Cloud Platform or Splunk Enterprise, edit permissions to allow the current or new search/delete users to access new indexes.
- If new HEC token or users are created, update the Phantom search settings.
Run `pkill --full add_to_searchindex` on each Phantom cluster node
Run `/home/phanru/phantomcyber/bin/phsvc restart uwsgi` on each Phantom cluster node
- Rerun Test Connection.
- All phantom search indexes must now be re-indexed.
```

--------------------------------

### Example GET Response for External Prompt

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.4.0/external-prompt-endpoints

A successful GET request to retrieve external prompt information returns a JSON object detailing the prompt's due time, status, action name, and target parameters, including secure links and response types.

```json
{
    "due_time": "2024-09-09T19:34:03.210000Z",
    "status": "pending",
    "action_name": "prompt_1",
    "targets": [
        {
            "app_id": 0,
            "assets": [],
            "parameters": [
                {
                    "to": null,
                    "ttl": 30,
                    "message": "msg",
                    "to_role": null,
                    "saml_group": null,
                    "mins_to_act": 30,
                    "secure_link": "https://example.splunkcloud.com/external-prompt/3vnHw1ZYH4G_u_f5w_caTwUPnERlH2PHaNVGDCNoMJY",
                    "saml_required": false,
                    "response_types": [
                        {
                            "prompt": "question1",
                            "options": {
                                "type": "message",
                                "required": true
                            }
                        }
                    ],
                    "external_prompt_id": "3vnHw1ZYH4G_u_f5w_caTwUPnERlH2PHaNVGDCNoMJY"
                }
            ]
        }
    ]
}
```

--------------------------------

### Splunk SOAR Firewall Configuration Example (firewalld)

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/install-and-upgrade-soar-on-premises/8.4.0/system-requirements/splunk-soar-on-premises-ports-and-endpoints

This snippet shows an example of the default firewalld settings for an unprivileged Splunk SOAR (On-premises) cluster. It lists the services and ports that are open, including those for HTTP, HTTPS, SSH, and RabbitMQ. Note that Splunk Connected experiences apps access is not enabled in this example.

```bash
[phantom@phantom ~]$ sudo firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: ens160 sources: services: dhcpv6-client http https ssh ports: 8443/tcp 27100-27200/tcp 5121/tcp 8300/tcp 8301/tcp 8302/tcp 4369/tcp 5671/tcp 25672/tcp 15672/tcp 443/tcp protocols: masquerade: no forward-ports: port=443:proto=tcp:toport=8443:toaddr= source-ports: icmp-blocks: rich rules:
```

```bash
[phantom@phantom ~]$ sudo firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens160
  sources:
  services: dhcpv6-client http https ssh
  ports: 8443/tcp 27100-27200/tcp 5121/tcp 8300/tcp 8301/tcp 8302/tcp 4369/tcp 5671/tcp 25672/tcp 15672/tcp 443/tcp
  protocols:
  masquerade: no
  forward-ports: port=443:proto=tcp:toport=8443:toaddr=
  source-ports:
  icmp-blocks:
  rich rules:
```

--------------------------------

### GET Container Information via REST API

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.0

This example shows how to retrieve container information from Splunk SOAR (On-premises) using a GET request to the REST API. It specifies the URL format and the required 'ph-auth-token' header for authentication. Successful requests return container details.

```json
https://{SOAR-url}/rest/container/{container_id}
```

--------------------------------

### Perform a Full Backup with ibackup

Source: https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.4.0/backup-or-restore-your-splunk-soar-on-premises-instance/splunk-soar-on-premises-backup-tools

Initiates a full backup of Splunk SOAR (On-premises) components. This command requires the `--backup` argument and can optionally specify components to include using `--backup-components` and the backup location with `--backup-path`.

```bash
phenv ibackup --backup --backup-components db,configuration,apps --backup-path /mnt/backups/soar
```
Tokens:
Raw