Splunk® Phantom (Legacy)

REST API Reference for Splunk Phantom

Acrobat logo Download manual as PDF


Splunk Phantom 4.10.7 is the final release of Splunk's Security Orchestration, Automation, and Response (SOAR) system to be called Splunk Phantom. All later versions are named Splunk SOAR (On-premises). For more information, see the Splunk SOAR (On-premises) documentation.
Acrobat logo Download topic as PDF

Delete Records

Records can be deleted by an authorized user. This can be done by issuing an HTTP DELETE to /rest/<type>/<id>. Deletion can only be done by a user account with the correct privileges and not by a connection authenticated using a REST token. The Python requests module implements both HTTP Basic user auth as well as HTTP DELETE.

/rest/<type>/<id>

Syntax

https://<username>:<password>@<host>/rest/<type>/<id>

DELETE

Delete a record.

Example Python request
Delete container Id 42.

requests.delete('https://192.168.1.1/rest/container/42', auth=('admin', 'password'))

Example response
A successful DELETE will return a success message.

{
    "success": true
}

Example curl request
Delete the custom CEF Id 151.

curl -k -u admin:changeme https://localhost/rest/cef/151 -X DELETE

Example response
A successful DELETE will return the success message.

{
    "success": true
}

Failures will return a non-200 response code and JSON with "failed" = true and an appropriate "message".

Delete is only supported for the following record types:

  • Apps (/rest//rest/app/<id>)
  • Artifacts (/rest/artifact/<id>)
  • Assets (/rest/asset/<id>)
  • CEF (/rest/cef/<id>)
  • Containers (/rest/container/<id>)
  • Container Attachments (vault files such as /rest/container_attachment/<id>)
  • Custom Lists (/rest/decided_list/<id>)

Custom Lists can be deleted with user or token authentication. All others require user authentication.

Last modified on 28 May, 2020
PREVIOUS
Bulk Create and Update Records
  NEXT
Get System Info

This documentation applies to the following versions of Splunk® Phantom (Legacy): 4.8, 4.9, 4.10, 4.10.1, 4.10.2, 4.10.3, 4.10.4, 4.10.6, 4.10.7


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters