To return all artifacts that contain a SHA1 file hash using the Splunk SOAR REST API, the correct

query would use the _filter_cef_Shal_contains parameter. This parameter filters the artifacts to only

those that contain a value in the SHA1 field within the Common Event Format (CEF) data

structure. The contains operator is used to match any artifacts that have a SHA1 hash present1.

Reference:

Understanding artifacts - Splunk Documentation

When the Splunk App for SOAR Export executes a Splunk search, it typically involves mapping

Common Information Model (CIM) fields from Splunk to the Common Event Format (CEF) used by

SOAR, after which a container is created on the SOAR server to house the related artifacts and

information. This process allows for the integration of data between Splunk, which uses CIM for data

normalization, and Splunk SOAR, which uses CEF as its data format for incidents and events.

Splunk App for SOAR Export is responsible for sending data from your Splunk Enterprise or Splunk

Cloud instances to Splunk SOAR. The Splunk App for SOAR Export acts as a translation service

between the Splunk platform and Splunk SOAR by performing the following tasks:

•

Mapping fields from Splunk platform alerts, such as saved searches and data models, to CEF

fields.

•

Translating CIM fields from Splunk Enterprise Security (ES) notable events to CEF fields.

•

Forwarding events in CEF format to Splunk SOAR, which are stored as artifacts.

Therefore, option B is the correct answer, as it states the activities that are completed when the

Splunk App for SOAR Export executes a Splunk search. Option A is incorrect, because CEF fields are

not mapped to CIM fields, but the other way around. Option C is incorrect, because a container is not

created on the Splunk server, but on the SOAR server. Option D is incorrect, because a container is

not created on the Splunk server, but on the SOAR server.

Splunk SOAR (formerly Phantom) does not natively run on Windows servers as it is primarily

designed for Linux environments. However, it can be deployed on a Windows server through

virtualization. By running the Phantom OVA (Open Virtualization Appliance) as a virtual machine,

users can utilize virtualization platforms like VMware or VirtualBox on a Windows server to host the

Phantom environment. This approach allows for the deployment of Phantom in a Windows-centric

infrastructure by leveraging virtualization technology to encapsulate the Phantom application within

a supported Linux environment provided by the OVA.

The correct answer is B because an active playbook can be configured to operate on all containers

that share a label. A label is a user-defined attribute that can be applied to containers to group them

by a common characteristic, such as source, type, severity, etc. Labels can be used to filter containers

and trigger active playbooks based on the label value. See Splunk SOAR Documentation for more

details.

In Splunk SOAR, labels are used to categorize containers (such as incidents or events) based on their

characteristics or the type of security issue they represent. An active playbook can be configured to

trigger on all containers that share a specific label, enabling targeted automation based on the

nature of the incident. This functionality allows for efficient and relevant playbook execution,

ensuring that the automated response is tailored to the specific requirements of the container's

category. Labels serve as a powerful organizational tool within SOAR, guiding the automated

response framework to act on incidents that meet predefined criteria, thus streamlining the security

operations process.

In Splunk SOAR, playbooks can execute actions either synchronously (waiting for one action to

complete before starting the next) or asynchronously (allowing actions to run concurrently). If a

playbook starts executing before the previous one has completed, it indicates that synchronous

execution has not been properly configured between these playbooks. This is crucial when the

output of one playbook is a dependency for the subsequent playbook. Options B, C, and D do not

directly address the observed behavior of concurrent playbook execution, making option A the most

accurate explanation for why the second playbook starts before the completion of the first.

synchronous execution is a feature of the SOAR automation engine that allows you to control the

order of execution of playbook blocks. Synchronous execution ensures that a playbook block waits for

the completion of the previous block before starting its execution. Synchronous execution can be

enabled or disabled for each playbook block in the playbook editor, by toggling the Synchronous

Execution switch in the block settings. Therefore, option A is the correct answer, as it states the cause

of the behavior where the second playbook starts executing before the first one completes. Option B

is incorrect, because the first playbook performing poorly is not the cause of the behavior, but rather

a possible consequence of the behavior. Option C is incorrect, because the sleep option for the

second playbook is not the cause of the behavior, but rather a workaround that can be used to delay

the execution of the second playbook. Option D is incorrect, because the join configuration on the

second playbook is not the cause of the behavior, but rather a way of merging multiple paths of

execution into one.

The primary objective of using the I2A2 playbook design methodology in Splunk SOAR is to create

playbooks that are simple, reusable, and modular. This design philosophy emphasizes the creation of

playbooks that can be easily understood and maintained, encourages the reuse of playbook

components in different scenarios, and fosters the development of playbooks that can be modularly

connected or used independently as needed.

I2A2 design methodology is a framework for designing playbooks that consists of four components:

•

Inputs: The data that is required for the playbook to run, such as artifacts, parameters, or

custom fields.

•

Interactions: The blocks that allow the playbook to communicate with users or other

systems, such as prompts, comments, or emails.

•

Actions: The blocks that execute the core logic of the playbook, such as app actions, filters,

decisions, or utilities.

•

Artifacts: The data that is generated or modified by the playbook, such as new artifacts,

container fields, or notes.

The I2A2 design methodology helps you to plan, structure, and test your playbooks in a modular and

efficient way. The primary objective of using the I2A2 design methodology is to create simple,

reusable, modular playbooks that can be easily maintained, shared, and customized. Therefore,

option D is the correct answer, as it states the primary objective of using the I2A2 design

methodology. Option A is incorrect, because creating detailed playbooks is not the primary objective

of using the I2A2 design methodology, but rather a possible outcome of following the framework.

Option B is incorrect, because creating playbooks that customers will not edit is not the primary

objective of using the I2A2 design methodology, but rather a potential risk of not following the

framework. Option C is incorrect, because meeting customer requirements using a single playbook is

not the primary objective of using the I2A2 design methodology, but rather a challenge that can be

overcome by using the framework.

1: Use a playbook design methodology in Administer Splunk SOAR (Cloud).

The global block within a Splunk SOAR playbook is primarily used to import external packages or

define global variables that will be utilized across various parts of the playbook. This block sets the

stage for the playbook by ensuring that all necessary libraries, modules, or predefined variables are

available for use in subsequent actions, decision blocks, or custom code segments within the

playbook. This practice promotes code reuse and efficiency, enabling more sophisticated and

powerful playbook designs by leveraging external functionalities.

When building a playbook in Splunk SOAR, if the desired artifact value does not appear in the auto-

populated list of input parameters for an action, users have the option to manually enter the

Common Event Format (CEF) datapath for that value. This allows for greater flexibility and

customization in playbook design, ensuring that specific data points can be targeted even if they're

not immediately visible in the interface. This manual entry of CEF datapaths allows users to directly

reference the necessary data within artifacts, bypassing limitations of the auto-populated list.

Options B, C, and D suggest alternative methods that are not typically used for this purpose, making

option A the correct and most direct approach to entering an unlisted artifact value in a playbook

action.

When assigning an input parameter to an action while building a playbook, a user can use the auto-

populated list of artifact values that match the expected data type for the parameter. The auto-

populated list is based on the contains parameter of the action inputs and outputs, which enables

contextual actions in the SOAR user interface. However, the auto-populated list may not include all

the possible artifact values that can be used as parameters, especially if the artifact values are nested

or have uncommon data types. In that case, the user can type the CEF datapath in manually, using

the syntax artifact.., where field is the name of the artifact field, such as cef, and key is

the name of the subfield within the artifact field, such as sourceAddress. Typing the CEF datapath in

manually allows the user to enter the unlisted artifact value as an input parameter to the action.

Therefore, option A is the correct answer, as it states how it is possible to enter the unlisted artifact

value. Option B is incorrect, because deleting and recreating the artifact is not a way to enter the

unlisted artifact value, but rather a way to lose the existing artifact data. Option C is incorrect,

because editing the artifact to enable the List as Parameter option for the CEF value is not a way to

enter the unlisted artifact value, but rather a way to make the artifact value appear in the auto-

populated list. Option D is incorrect, because editing the container to allow CEF parameters is not a

way to enter the unlisted artifact value, but rather a way to modify the container properties, which

are not related to the action parameters.

To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute

Playbook' capability must be managed appropriately. This is done by ensuring that this capability is

removed from all other roles except the admin role. Role-based access control (RBAC) in Splunk

SOAR allows for granular permissions, which means you can configure which roles have the ability to

execute playbooks, and by restricting this capability, you can control which users are able to initiate

playbook runs.

DECIDED process is a core component of the SOAR automation engine that handles the execution of

playbooks and actions. The DECIDED process can be restarted by restarting the automation service,

which can be done from the command line using the service phantom restart command2. Restarting

the automation service also restarts the playbook daemon, which is another core component of the

SOAR automation engine that handles the loading and unloading of playbooks3. Therefore, option D

is the correct answer, as it restarts both the DECIDED process and the playbook daemon. Option A is

incorrect, because restarting the playbook daemon alone does not restart the DECIDED process.

Option B is incorrect, because the System Health page does not provide an option to restart the

DECIDED process or the automation service. Option C is incorrect, because the Administration >

Server Settings page does not provide an option to restart the DECIDED process or the automation

service.

In Splunk SOAR, if the DECIDED process, which is responsible for playbook execution, needs to be

restarted, this can typically be done by restarting the automation (or phantom) service. This service

manages the automation processes, including playbook execution. Restarting it can reset the

DECIDED process, resolving issues related to playbook execution or process hangs.