Splunk SOAR SDK Documentation

The Splunk SOAR SDK is the official tool and library for building connectors that integrate with Splunk SOAR. You can use it to create new apps, convert old-style apps to the new format, and test your apps locally before deploying them to a Splunk SOAR instance.

If you want to learn more about how to use the SDK, check out the following resources:

• Getting Started: A step-by-step guide to creating your first Splunk SOAR app using the SDK.

• App Structure: Detailed information on the structure of a Splunk SOAR app and its components.

• API Reference: Comprehensive reference for the SDK’s Python API.

• CLI Reference: Documentation for the SDK’s command-line interface (CLI) tool.

If you find bugs, need help, or have suggestions, please visit the Splunk SOAR SDK GitHub repository and file an issue.

What is a Splunk SOAR App and What are Actions?

Apps (aka Connectors) in Splunk SOAR are extensions that enrich the platform functionality. Each app provides a new set of actions that can be used to automate security investigations and response. Usually, a single app adds actions which integrate with a specific tool or 3rd party service (e.g. whois lookup or geolocation).

This SDK is a set of tools to build, test and run your own app that will extend Splunk SOAR by implementing actions which integrate with 3rd parties.

Splunk SOAR Compatibility

The Splunk SOAR SDK codifies its minimum supported Splunk SOAR version under soar_sdk.compat.MIN_PHANTOM_VERSION:

MIN_PHANTOM_VERSION = "7.0.0"

By default, any Splunk SOAR app developed with this version of the SDK will run on all released Splunk SOAR versions above that minimum*.

Both Splunk SOAR Cloud and Splunk SOAR On-Prem are supported at this defined minimum version and above.

Note

* Forward-compatibility is not guaranteed, but is strived for. Backward-compatibility is guaranteed down to the MIN_PHANTOM_VERSION

Contents

• Getting Started
  • Installation
    • Prerequisites
    • Installing the SDK as a Tool
  • Building an App
    • Creating the App Skeleton
    • The App Structure
      • The src Directory and the app.py File
      • The logo*.svg Files
      • The pyproject.toml Configuration File
    • Configuring a Development Environment
  • Defining Your App’s Asset Configuration
  • Creating Your First Actions
    • The test connectivity Action
    • Your First Action
    • action() Decorator
    • The Action Declaration
    • The Action Docstring
    • The Action Result
  • Testing and Building the App
    • Running From the Command Line
    • Building an App Package
    • Installing and Running the App
  • Getting Help
  • Next Steps
• App Structure
  • pyproject.toml
  • src/app.py
    • Components of the app.py File
      • Logger Initialization
      • Asset Definition
      • App Initialization
      • Action Definitions
      • App CLI Invocation
  • .pre-commit-config.yaml
• Custom Views
  • View Handlers
    • Basic Handler Structure
    • Handler Parameters
      • Input: Action Results
      • Return: Template Data
    • Decorator Options
      • Using Templates
      • Using Components
    • Attaching to Actions
  • Templates
    • Template Location
      • SDK-Specific Filters
    • Widget Templates
      • Base Template Options
      • Override Base Template Blocks
      • Theming
      • Example Template
      • Auto-escaping and Security
  • Reusable Components
    • How Components Work
    • Usage
      • Pie Chart Component
• API Reference
  • Jump to a Section:
  • The App Class
    • App
      • App.__init__()
      • App.get_actions()
      • App.cli()
      • App.handle()
      • App.create_soar_client_auth_object()
      • App.__call__()
      • App.asset
      • App.on_es_poll()
      • App.make_request()
      • App.webhook_meta
      • App.webhook_router
      • App.webhook()
      • App.handle_webhook()
    • Key App Methods
      • App.action()
      • App.test_connectivity()
      • App.on_poll()
      • App.register_action()
      • App.enable_webhooks()
      • App.view_handler()
    • Asset Configuration
      • AssetField
      • BaseAsset
    • Action Parameters
      • Adding Extra Metadata
      • Defining Parameters
      • Parameters For on poll
      • Parameters for the Make Request Action
    • Action Outputs
      • Defining Action Outputs
      • Make Request Action Output
    • SOARClient
      • SOARClient
  • APIs
    • Artifact API
      • Artifact
    • Container API
      • Container
    • Vault API
      • Vault
  • Data Models
    • Artifact
      • Artifact.model_config
      • Artifact.name
      • Artifact.label
      • Artifact.description
      • Artifact.type
      • Artifact.severity
      • Artifact.source_data_identifier
      • Artifact.container_id
      • Artifact.data
      • Artifact.run_automation
      • Artifact.owner_id
      • Artifact.cef
      • Artifact.cef_types
      • Artifact.ingest_app_id
      • Artifact.tags
      • Artifact.start_time
      • Artifact.end_time
      • Artifact.kill_chain
      • Artifact.to_dict()
    • Container
      • Container.model_config
      • Container.name
      • Container.label
      • Container.description
      • Container.source_data_identifier
      • Container.external_id
      • Container.severity
      • Container.status
      • Container.tags
      • Container.owner_id
      • Container.sensitivity
      • Container.artifacts
      • Container.asset_id
      • Container.close_time
      • Container.custom_fields
      • Container.data
      • Container.due_time
      • Container.end_time
      • Container.ingest_app_id
      • Container.kill_chain
      • Container.role_id
      • Container.run_automation
      • Container.start_time
      • Container.open_time
      • Container.tenant_id
      • Container.container_type
      • Container.template_id
      • Container.authorized_users
      • Container.artifact_count
      • Container.container_id
      • Container.to_dict()
    • VaultAttachment
      • VaultAttachment.id
      • VaultAttachment.created_via
      • VaultAttachment.container
      • VaultAttachment.task
      • VaultAttachment.create_time
      • VaultAttachment.name
      • VaultAttachment.user
      • VaultAttachment.vault_document
      • VaultAttachment.mime_type
      • VaultAttachment.es_attachment_id
      • VaultAttachment.hash
      • VaultAttachment.vault_id
      • VaultAttachment.size
      • VaultAttachment.path
      • VaultAttachment.metadata
      • VaultAttachment.aka
      • VaultAttachment.container_id
      • VaultAttachment.contains
      • VaultAttachment.open()
      • VaultAttachment.model_config
    • ViewContext
      • ViewContext.QS
      • ViewContext.container
      • ViewContext.app
      • ViewContext.no_connection
      • ViewContext.google_maps_key
      • ViewContext.dark_title_logo
      • ViewContext.title_logo
      • ViewContext.app_name
      • ViewContext.results
      • ViewContext.html_content
      • ViewContext.model_config
    • ResultSummary
      • ResultSummary.total_objects
      • ResultSummary.total_objects_successful
      • ResultSummary.model_config
  • Logging
    • getLogger
    • info
    • debug
    • progress
    • warning
    • error
    • critical
  • Exceptions
    • ActionFailure
      • ActionFailure.__str__()
    • ActionRegistrationError
    • AssetMisconfiguration
      • AssetMisconfiguration.__str__()
    • SoarAPIError
      • SoarAPIError.__str__()
• CLI Reference
  • soarapps
    • version
    • manifests
      • display
      • create
    • package
      • build
      • install
    • init
    • convert
    • test
      • unit
      • integration
  • App CLI
• Changelog

Indices and Tables

• Index

• Module Index

• Search Page