Network automation API

Splunk Phantom's Automation API allows security operations teams to develop detailed and precise automation strategies. Playbooks can serve many purposes, ranging from automating minimal investigative tasks that can speed up analysis to large-scale response to a security breach. The following APIs are supported to leverage the capabilities of the platform using Playbooks.

valid_ip

phantom.valid_ip(address)

This API validates an IPv4 address

valid_net

phantom.valid_net(net)

This API validates a CIDR notation of IPv4 address range

address_in_network

phantom.address_in_network(ip, net)

This API checks to see if the ipaddress is in the user specified ip address range expressed in CIDR format.

Parameter	Description
ip	This is the IPv4 address that has to be checked.
net	This is the IPv4 CIDR notation expressing the IP address range that needs to be tested.

attacker_ips, victim_ips

phantom.attacker_ips(container, scope='new')
phantom.victim_ips(container, scope='new')

Parameter	Description
container	This is the container object passed in to on_start() or any action callbacks. Just pass it as is to the API.
scope	For more details about this parameter please read phantom.collect(). The parameter defaults to 'new' or you can pass 'all' to collect the field values from all artifacts.

Review the phantom.collect() API before using, as these convenience APIs have very limited use scenarios. These APIs return an attacker or victim value depending on the CEF deviceDirection, sourceAddress, and destinationAddress fields.

• If deviceDirection is 'inbound' or not present: sourceAddress is returned as the 'attacker' IP address and destinationAddress is returned as the 'victim' IP address.
• If deviceDirection is 'outbound' then the destinationAddress is returned as the 'attacker' IP address and sourceAddress is returned as the 'victim' IP address.