Splunk® SOAR (Cloud)

Build Playbooks with the Playbook Editor

The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:

Use filters to separate artifacts before further processing with the classic playbook editor

Create conditions in a Filter block to separate a subset of artifacts. Only the artifacts matching the specified condition are passed along to downstream blocks for processing. This is useful when you want to remove artifacts that aren't needed in the flow of the playbook, or you need to separate artifacts because they require different blocks for processing. For example:

  • If an IP address comes from North Korea or Turkey, you can block it.
  • If an IP address comes from North America, you can perform an IP reputation lookup.
  • If an IP address falls in the 192.168.10.* range, you can to grant access to the user.

Options in a filter aren't related to each other and you can perform multiple actions on an IP address. For example, both the second and third conditions in the example could be true, as an IP address in the 192.168.10.* range could both come from North America and be an internal user who was granted access. The filtered data set is given a named result in the format name="filter_1:condition_1" and passed to the next block for processing.

Create a Filter block in your playbook

To create a Filter block, perform the following tasks:

  1. Create a new block in the classic playbook editor.
  2. Select Filter from the list of block types.
  3. Select the Select Parameter field and select the parameter you want to filter on. Parameters are made available to the Filter block by upstream blocks.
  4. Select the == field and select an operator for the filter.
  5. Select the Select Value field and select the value you want to match. See Example of creating a filter for an example of how these fields work together.
  6. (Optional) Select + to add parameters to this condition.
  7. (Optional) Select Add Condition to create another matching condition for the filter. You can have a maximum of five conditions per Filter block. Each condition has its own downstream path.

Example of creating a filter

In the following example, you can create a filter to perform a geolocate ip action on a source IP address and block any IP addresses from North Korea. The following image shows the classic playbook editor in .

This screen image shows the classic playbook editor in Splunk SOAR (Cloud). From left to right, there is a Start Block connected to a geolocate_ip action block, which is then connected to a filter. The filter block parameters are described in the text immediately following this image.

  1. Configure a geolocate ip action in the playbook editor.
  2. Drag the half-circle icon on the geolocate ip action block in the editor.
  3. Select Filter from the list of block types.
  4. Select the Select Parameter field and select geolocate_ip_1.
  5. Select geolocate_ip_1:action_result_data.*.country_name.
  6. Leave == as the operator, and type North Korea in the Select Value field.

Example of creating a filter with multiple conditions

You can create multiple rows within a condition or multiple conditions. The following image shows an example of the classic playbook editor in .

This screen image shows the classic playbook editor in Splunk SOAR (Cloud). From left to right, there is a Start Block connected to a geolocate_ip action block, which is then connected to a filter. The filter block parameters are described in the text immediately following this image.

  1. Select Add Condition to create a second set of filter conditions, which also adds a second output point on the Filter block.
  2. In the Select Parameter field, select container properties and choose label.
  3. Select == as the operator, and enter Test in the Select Value field.

Multiple conditions within a filter block are independent of each other. The results of Condition 1 don't play into the set of inputs for Condition 2. In this example, Condition 1 uses the result from the geolocate ip action, while Condition 2 uses a property of the container. Each condition has its own color to make it easier to identify the separate downstream actions. Green marks the path of Condition 1 and purple marks the path of Condition 2.

Example of filter chaining

You can also chain multiple filter blocks together to obtain a more specific set of data. The following image shows a chain of filters in the classic playbook editor.

This screen image shows a chain of filters in the Playbook Editor. From left to right, the blocks are Start, Filter 1, Filter 2, Filter 3, a lookup IP action block, and the End block.

For example, to filter out RFC1918 addresses (10.x.x.x, 172.16.x.x-172.31.x.x, and 192.168.x.x) and perform a geolocate ip action on the remaining addresses, perform the following steps:

  1. From the Start block, create a new filter block.
  2. In the Select Parameter field, select event > src_ip.
  3. Select == and choose not in for the operator.
  4. Enter 10.0.0.0/8 in the Select Value field. This will filter out any IP addresses not in that range.
  5. Create a second filter for the 172.16.0.0/12 IP addresses. Select the filtered results from the previous block for the parameter.
  6. Create a third filter for the 192.168.0.0/16 IP addresses. Select the filtered results from the previous block for the parameter.
  7. Create the geolocate ip action block using the filtered results from the last filter block in the chain.

If a filter block eliminates all variables while filtering, the downstream action can't run.

Example of using a custom list in a filter

You can use custom lists in your Filter blocks to simplify checking against a fixed set of items. For example, instead of checking the source country of an IP address to see if it is North Korea, you can define a list of countries in a custom list, then check the IP address against all of the countries in the list. You can maintain custom lists using the web interface, REST API, and playbook API. See Create custom lists for use in playbooks in Use . The following image shows the classic playbook editor in .

This screen image shows the classic playbook editor in Splunk SOAR (Cloud). From left to right, there is a Start Block connected to a geolocate_ip action block, which is then connected to a filter. The filter block parameters are described in the text immediately following this image.

In this example, use a custom list named Banned Countries in a filter by performing the following tasks:

  1. Configure a geolocate ip action in the playbook editor.
  2. Drag the half-circle icon on the geolocate ip action block in the editor.
  3. Select Filter from the list of block types.
  4. Select the Select Parameter field and select geolocate_ip_1.
  5. Select geolocate_ip_1:action_result_data.*.country_name.
  6. Use "in" or "not in" as the operator.
  7. Select the Select value field and select custom_list:Banned_Countries.

The country name of the source IP address is checked against the countries defined in the Banned Countries custom list.

Last modified on 29 May, 2024
Add an Action block to a playbook using the classic playbook editor   Use decisions to send artifacts to a specific downstream action with the classic playbook editor

This documentation applies to the following versions of Splunk® SOAR (Cloud): current, current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters