[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HMD5BA931AAJS461W3NJVT":3,"skill-same:01M6HMD5BA931AAJS461W3NJVT":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":69,"repositoryHtmlUrl":70,"repositoryHomepageUrl":6,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6HMD5BA931AAJS461W3NJVT","implementing-soar-automation-with-phantom",null,"Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-soar-automation-with-phantom\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"soar","implementing","automation","with","implementing soar automation with phantom","phantom","t1078","reduce","de","incident","cm","t1566","cybersecurity","soar-automation","splunk","soc","actions","workflows","orchestration","incident response","2026-11-10 10:12:30",false,"---\nname: implementing-soar-automation-with-phantom\ndescription: Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce...\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- soar\n- phantom\n- splunk-soar\n- automation\n- playbook\n- orchestration\n- incident-response\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\ncategory: implementing-soar-automation-with-phantom\n---\n# Implementing-Soar-Automation-With-Phantom\n\n## Overview\nImplements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.\n\n\n# Implementing SOAR Automation with Phantom\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to automate repetitive triage and enrichment tasks for high-volume alerts\n- Manual response times exceed SLA requirements and automation can reduce MTTR\n- Multiple security tools (SIEM, EDR, firewall, TIP) need orchestrated response actions\n- Playbook standardization is required to ensure consistent analyst response across shifts\n\n**Do not use** for fully autonomous containment without human approval gates — always include analyst decision points for high-impact actions like account disabling or host isolation.\n\n## Prerequisites\n\n- Splunk SOAR (Phantom) 6.x+ deployed with web interface access\n- App connectors configured: VirusTotal, CrowdStrike, ServiceNow, Active Directory, Splunk ES\n- Splunk ES integration for ingesting notable events as SOAR events\n- API credentials for each integrated tool stored in SOAR asset configuration\n- Python knowledge for custom playbook actions\n\n## Workflow\n\n### Step 1: Configure Asset Connections\n\nSet up integrations with security tools via SOAR Apps:\n\n**VirusTotal Asset Configuration:**\n```json\n{\n  \"app\": \"VirusTotal v3\",\n  \"asset_name\": \"virustotal_prod\",\n  \"configuration\": {\n    \"api_key\": \"YOUR_VT_API_KEY\",\n    \"rate_limit\": true,\n    \"max_requests_per_minute\": 4\n  },\n  \"product_vendor\": \"VirusTotal\",\n  \"product_name\": \"VirusTotal\"\n}\n```\n\n**CrowdStrike Falcon Asset:**\n```json\n{\n  \"app\": \"CrowdStrike Falcon\",\n  \"asset_name\": \"crowdstrike_prod\",\n  \"configuration\": {\n    \"client_id\": \"CS_CLIENT_ID\",\n    \"client_secret\": \"CS_CLIENT_SECRET\",\n    \"base_url\": \"https:\u002F\u002Fapi.crowdstrike.com\"\n  }\n}\n```\n\n**Active Directory Asset:**\n```json\n{\n  \"app\": \"Active Directory\",\n  \"asset_name\": \"ad_prod\",\n  \"configuration\": {\n    \"server\": \"dc01.company.com\",\n    \"username\": \"soar_service@company.com\",\n    \"password\": \"SERVICE_ACCOUNT_PASSWORD\",\n    \"ssl\": true\n  }\n}\n```\n\n### Step 2: Build Phishing Triage Playbook\n\nCreate an automated phishing response playbook in Python (Phantom playbook format):\n\n```python\n\"\"\"\nPhishing Triage Automation Playbook\nTrigger: New phishing email reported via Splunk ES notable or email ingestion\n\"\"\"\n\nimport phantom.rules as phantom\nimport json\n\ndef on_start(container):\n    # Extract artifacts (URLs, file hashes, sender) from the container\n    artifacts = phantom.get_artifacts(container_id=container[\"id\"])\n\n    for artifact in artifacts:\n        artifact_type = artifact.get(\"cef\", {}).get(\"type\", \"\")\n\n        if artifact_type == \"url\":\n            phantom.act(\"url reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=url_reputation_callback,\n                        name=\"url_reputation\")\n\n        elif artifact_type == \"hash\":\n            phantom.act(\"file reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=hash_reputation_callback,\n                        name=\"file_reputation\")\n\n        elif artifact_type == \"ip\":\n            phantom.act(\"ip reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=ip_reputation_callback,\n                        name=\"ip_reputation\")\n\ndef url_reputation_callback(action, success, container, results, handle):\n    if not success:\n        phantom.comment(container, \"URL reputation check failed\")\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious_count = data.get(\"summary\", {}).get(\"malicious\", 0)\n        total_engines = data.get(\"summary\", {}).get(\"total_engines\", 0)\n\n        if malicious_count > 5:\n            # High confidence malicious — auto-block and escalate\n            phantom.act(\"block url\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_url\")\n\n            phantom.set_severity(container, \"high\")\n            phantom.set_status(container, \"open\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Blocked on firewall. Escalating to Tier 2.\")\n\n            # Create ServiceNow ticket\n            phantom.act(\"create ticket\", targets=container,\n                        assets=[\"servicenow_prod\"],\n                        parameters=[{\n                            \"short_description\": f\"Phishing - Malicious URL detected\",\n                            \"urgency\": \"2\",\n                            \"impact\": \"2\"\n                        }],\n                        name=\"create_incident_ticket\")\n\n        elif malicious_count > 0:\n            # Medium confidence — request analyst review\n            phantom.promote(container, template=\"Phishing Investigation\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Requires analyst review.\")\n\n        else:\n            # Clean — close with comment\n            phantom.set_status(container, \"closed\")\n            phantom.comment(container,\n                f\"URL clean: 0\u002F{total_engines} engines flagged. Auto-closed.\")\n\ndef hash_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        positives = data.get(\"summary\", {}).get(\"positives\", 0)\n\n        if positives > 10:\n            # Known malware — quarantine and block\n            phantom.act(\"quarantine device\", targets=result,\n                        assets=[\"crowdstrike_prod\"],\n                        name=\"isolate_endpoint\")\n            phantom.set_severity(container, \"high\")\n\ndef ip_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious = data.get(\"summary\", {}).get(\"malicious\", 0)\n\n        if malicious > 3:\n            phantom.act(\"block ip\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_ip\")\n```\n\n### Step 3: Build Alert Enrichment Playbook\n\nAutomate enrichment for all incoming SIEM alerts:\n\n```python\n\"\"\"\nUniversal Alert Enrichment Playbook\nRuns on every new event to add context before analyst review\n\"\"\"\n\nimport phantom.rules as phantom\n\ndef on_start(container):\n    # Get all artifacts\n    success, message, artifacts = phantom.get_artifacts(\n        container_id=container[\"id\"], full_data=True\n    )\n\n    ip_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"sourceAddress\")]\n    domain_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"destinationDnsDomain\")]\n\n    # Enrich IPs in parallel\n    for artifact in ip_artifacts:\n        ip = artifact[\"cef\"][\"sourceAddress\"]\n\n        # VirusTotal lookup\n        phantom.act(\"ip reputation\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"virustotal_prod\"],\n                    callback=enrich_ip_callback,\n                    name=f\"vt_ip_{ip}\")\n\n        # GeoIP lookup\n        phantom.act(\"geolocate ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"maxmind_prod\"],\n                    callback=geoip_callback,\n                    name=f\"geo_{ip}\")\n\n        # Whois lookup\n        phantom.act(\"whois ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"whois_prod\"],\n                    name=f\"whois_{ip}\")\n\n    # Enrich domains\n    for artifact in domain_artifacts:\n        domain = artifact[\"cef\"][\"destinationDnsDomain\"]\n        phantom.act(\"domain reputation\",\n                    parameters=[{\"domain\": domain}],\n                    assets=[\"virustotal_prod\"],\n                    name=f\"vt_domain_{domain}\")\n\ndef enrich_ip_callback(action, success, container, results, handle):\n    \"\"\"Update container with enrichment data\"\"\"\n    if success:\n        for result in results:\n            summary = result.get(\"summary\", {})\n            phantom.add_artifact(container, {\n                \"cef\": {\n                    \"vt_malicious\": summary.get(\"malicious\", 0),\n                    \"vt_suspicious\": summary.get(\"suspicious\", 0),\n                    \"enrichment_source\": \"VirusTotal\"\n                },\n                \"label\": \"enrichment\",\n                \"name\": \"VT IP Enrichment\"\n            })\n```\n\n### Step 4: Implement Approval Gates for High-Impact Actions\n\nAdd human-in-the-loop for critical actions:\n\n```python\ndef containment_decision(action, success, container, results, handle):\n    \"\"\"Present analyst with containment options\"\"\"\n    phantom.prompt(\n        container=container,\n        user=\"soc_tier2\",\n        message=(\n            \"Confirmed malicious activity detected.\\n\"\n            f\"Host: {container['artifacts'][0]['cef'].get('sourceAddress')}\\n\"\n            f\"Threat: {results[0]['summary'].get('threat_name')}\\n\\n\"\n            \"Select containment action:\"\n        ),\n        respond_in_mins=15,\n        options=[\"Isolate Host\", \"Disable Account\", \"Both\", \"Monitor Only\"],\n        callback=execute_containment\n    )\n\ndef execute_containment(action, success, container, results, handle):\n    response = results.get(\"response\", \"Monitor Only\")\n\n    if response in [\"Isolate Host\", \"Both\"]:\n        phantom.act(\"quarantine device\",\n                    parameters=[{\"hostname\": container[\"artifacts\"][0][\"cef\"][\"sourceHostName\"]}],\n                    assets=[\"crowdstrike_prod\"],\n                    name=\"isolate_host\")\n\n    if response in [\"Disable Account\", \"Both\"]:\n        phantom.act(\"disable user\",\n                    parameters=[{\"username\": container[\"artifacts\"][0][\"cef\"][\"sourceUserName\"]}],\n                    assets=[\"ad_prod\"],\n                    name=\"disable_account\")\n\n    phantom.comment(container, f\"Analyst approved: {response}\")\n```\n\n### Step 5: Configure Playbook Scheduling and Triggers\n\nSet up event triggers in SOAR:\n\n```json\n{\n  \"playbook_name\": \"phishing_triage_automation\",\n  \"trigger\": {\n    \"type\": \"event_created\",\n    \"conditions\": {\n      \"label\": [\"phishing\", \"notable\"],\n      \"severity\": [\"high\", \"medium\"]\n    }\n  },\n  \"active\": true,\n  \"run_as\": \"automation_user\"\n}\n```\n\n### Step 6: Monitor Playbook Performance\n\nTrack automation effectiveness with SOAR metrics:\n\n```python\n# Query SOAR API for playbook execution stats\nimport requests\n\nheaders = {\"ph-auth-token\": \"YOUR_SOAR_TOKEN\"}\nresponse = requests.get(\n    \"https:\u002F\u002Fsoar.company.com\u002Frest\u002Fplaybook_run\",\n    headers=headers,\n    params={\n        \"page_size\": 100,\n        \"filter\": '{\"status\":\"success\"}',\n        \"sort\": \"create_time\",\n        \"order\": \"desc\"\n    }\n)\nruns = response.json()[\"data\"]\n\n# Calculate automation metrics\ntotal_runs = len(runs)\navg_duration = sum(r[\"end_time\"] - r[\"start_time\"] for r in runs) \u002F total_runs\nauto_closed = sum(1 for r in runs if r.get(\"auto_resolved\"))\nprint(f\"Total runs: {total_runs}\")\nprint(f\"Avg duration: {avg_duration:.1f}s\")\nprint(f\"Auto-resolved: {auto_closed}\u002F{total_runs} ({auto_closed\u002Ftotal_runs*100:.0f}%)\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SOAR** | Security Orchestration, Automation, and Response — platform integrating security tools with automated playbooks |\n| **Playbook** | Automated workflow defining sequential and parallel actions triggered by security events |\n| **Asset** | SOAR configuration for a connected security tool (API endpoint, credentials, connection parameters) |\n| **Container** | SOAR event object containing artifacts (IOCs) from an ingested alert or incident |\n| **Artifact** | Individual IOC or data point within a container (IP, hash, URL, domain, email) |\n| **Approval Gate** | Human-in-the-loop step requiring analyst decision before executing high-impact automated actions |\n\n## Tools & Systems\n\n- **Splunk SOAR (Phantom)**: Enterprise SOAR platform with 300+ app integrations and visual playbook editor\n- **Splunk ES**: SIEM platform feeding notable events into SOAR as containers for automated triage\n- **CrowdStrike Falcon**: EDR platform integrated via SOAR for automated host isolation and threat hunting\n- **ServiceNow**: ITSM platform integrated for automated incident ticket creation and tracking\n- **Palo Alto NGFW**: Firewall integrated for automated IP\u002FURL blocking via SOAR playbooks\n\n## Common Scenarios\n\n- **Phishing Triage**: Auto-extract URLs\u002Fattachments, detonate in sandbox, block malicious, create ticket\n- **Malware Alert Enrichment**: Auto-enrich file hashes across VT\u002FMalwareBazaar, isolate if confirmed malicious\n- **Brute Force Response**: Auto-check if attack succeeded, disable account if compromised, block source IP\n- **Threat Intel IOC Processing**: Auto-ingest TI feed IOCs, check against internal logs, create blocks for matches\n- **Vulnerability Alert Response**: Auto-query asset database for affected systems, create patching ticket with priority\n\n## Output Format\n\n```\nSOAR PLAYBOOK EXECUTION REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPlaybook:     Phishing Triage Automation v2.3\nContainer:    SOAR-2024-08921\nTrigger:      Notable event from Splunk ES (phishing)\n\nActions Executed:\n  [1] URL Reputation (VirusTotal)     — 14\u002F90 engines malicious    [2.1s]\n  [2] IP Reputation (AbuseIPDB)       — Confidence: 85%            [1.3s]\n  [3] Block URL (Palo Alto)           — Blocked on PA-5260         [0.8s]\n  [4] Block IP (Palo Alto)            — Blocked on PA-5260         [0.7s]\n  [5] Create Ticket (ServiceNow)      — INC0012345 created         [1.5s]\n  [6] Prompt Analyst (Tier 2)         — Response: \"Isolate Host\"   [4m 12s]\n  [7] Quarantine Device (CrowdStrike) — WORKSTATION-042 isolated   [3.2s]\n\nTotal Duration:    4m 22s (vs 35min avg manual triage)\nTime Saved:        ~31 minutes\nDisposition:       True Positive — Escalated to IR\n```\n","# Implementing-Soar-Automation-With-Phantom\n\n## Overview\nImplements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.\n\n\n# Implementing SOAR Automation with Phantom\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to automate repetitive triage and enrichment tasks for high-volume alerts\n- Manual response times exceed SLA requirements and automation can reduce MTTR\n- Multiple security tools (SIEM, EDR, firewall, TIP) need orchestrated response actions\n- Playbook standardization is required to ensure consistent analyst response across shifts\n\n**Do not use** for fully autonomous containment without human approval gates — always include analyst decision points for high-impact actions like account disabling or host isolation.\n\n## Prerequisites\n\n- Splunk SOAR (Phantom) 6.x+ deployed with web interface access\n- App connectors configured: VirusTotal, CrowdStrike, ServiceNow, Active Directory, Splunk ES\n- Splunk ES integration for ingesting notable events as SOAR events\n- API credentials for each integrated tool stored in SOAR asset configuration\n- Python knowledge for custom playbook actions\n\n## Workflow\n\n### Step 1: Configure Asset Connections\n\nSet up integrations with security tools via SOAR Apps:\n\n**VirusTotal Asset Configuration:**\n```json\n{\n  \"app\": \"VirusTotal v3\",\n  \"asset_name\": \"virustotal_prod\",\n  \"configuration\": {\n    \"api_key\": \"YOUR_VT_API_KEY\",\n    \"rate_limit\": true,\n    \"max_requests_per_minute\": 4\n  },\n  \"product_vendor\": \"VirusTotal\",\n  \"product_name\": \"VirusTotal\"\n}\n```\n\n**CrowdStrike Falcon Asset:**\n```json\n{\n  \"app\": \"CrowdStrike Falcon\",\n  \"asset_name\": \"crowdstrike_prod\",\n  \"configuration\": {\n    \"client_id\": \"CS_CLIENT_ID\",\n    \"client_secret\": \"CS_CLIENT_SECRET\",\n    \"base_url\": \"https:\u002F\u002Fapi.crowdstrike.com\"\n  }\n}\n```\n\n**Active Directory Asset:**\n```json\n{\n  \"app\": \"Active Directory\",\n  \"asset_name\": \"ad_prod\",\n  \"configuration\": {\n    \"server\": \"dc01.company.com\",\n    \"username\": \"soar_service@company.com\",\n    \"password\": \"SERVICE_ACCOUNT_PASSWORD\",\n    \"ssl\": true\n  }\n}\n```\n\n### Step 2: Build Phishing Triage Playbook\n\nCreate an automated phishing response playbook in Python (Phantom playbook format):\n\n```python\n\"\"\"\nPhishing Triage Automation Playbook\nTrigger: New phishing email reported via Splunk ES notable or email ingestion\n\"\"\"\n\nimport phantom.rules as phantom\nimport json\n\ndef on_start(container):\n    # Extract artifacts (URLs, file hashes, sender) from the container\n    artifacts = phantom.get_artifacts(container_id=container[\"id\"])\n\n    for artifact in artifacts:\n        artifact_type = artifact.get(\"cef\", {}).get(\"type\", \"\")\n\n        if artifact_type == \"url\":\n            phantom.act(\"url reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=url_reputation_callback,\n                        name=\"url_reputation\")\n\n        elif artifact_type == \"hash\":\n            phantom.act(\"file reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=hash_reputation_callback,\n                        name=\"file_reputation\")\n\n        elif artifact_type == \"ip\":\n            phantom.act(\"ip reputation\", targets=artifact,\n                        assets=[\"virustotal_prod\"],\n                        callback=ip_reputation_callback,\n                        name=\"ip_reputation\")\n\ndef url_reputation_callback(action, success, container, results, handle):\n    if not success:\n        phantom.comment(container, \"URL reputation check failed\")\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious_count = data.get(\"summary\", {}).get(\"malicious\", 0)\n        total_engines = data.get(\"summary\", {}).get(\"total_engines\", 0)\n\n        if malicious_count > 5:\n            # High confidence malicious — auto-block and escalate\n            phantom.act(\"block url\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_url\")\n\n            phantom.set_severity(container, \"high\")\n            phantom.set_status(container, \"open\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Blocked on firewall. Escalating to Tier 2.\")\n\n            # Create ServiceNow ticket\n            phantom.act(\"create ticket\", targets=container,\n                        assets=[\"servicenow_prod\"],\n                        parameters=[{\n                            \"short_description\": f\"Phishing - Malicious URL detected\",\n                            \"urgency\": \"2\",\n                            \"impact\": \"2\"\n                        }],\n                        name=\"create_incident_ticket\")\n\n        elif malicious_count > 0:\n            # Medium confidence — request analyst review\n            phantom.promote(container, template=\"Phishing Investigation\")\n            phantom.comment(container,\n                f\"URL flagged by {malicious_count}\u002F{total_engines} engines. \"\n                f\"Requires analyst review.\")\n\n        else:\n            # Clean — close with comment\n            phantom.set_status(container, \"closed\")\n            phantom.comment(container,\n                f\"URL clean: 0\u002F{total_engines} engines flagged. Auto-closed.\")\n\ndef hash_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        positives = data.get(\"summary\", {}).get(\"positives\", 0)\n\n        if positives > 10:\n            # Known malware — quarantine and block\n            phantom.act(\"quarantine device\", targets=result,\n                        assets=[\"crowdstrike_prod\"],\n                        name=\"isolate_endpoint\")\n            phantom.set_severity(container, \"high\")\n\ndef ip_reputation_callback(action, success, container, results, handle):\n    if not success:\n        return\n\n    for result in results:\n        data = result.get(\"data\", [{}])[0]\n        malicious = data.get(\"summary\", {}).get(\"malicious\", 0)\n\n        if malicious > 3:\n            phantom.act(\"block ip\", targets=result,\n                        assets=[\"palo_alto_prod\"],\n                        name=\"block_malicious_ip\")\n```\n\n### Step 3: Build Alert Enrichment Playbook\n\nAutomate enrichment for all incoming SIEM alerts:\n\n```python\n\"\"\"\nUniversal Alert Enrichment Playbook\nRuns on every new event to add context before analyst review\n\"\"\"\n\nimport phantom.rules as phantom\n\ndef on_start(container):\n    # Get all artifacts\n    success, message, artifacts = phantom.get_artifacts(\n        container_id=container[\"id\"], full_data=True\n    )\n\n    ip_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"sourceAddress\")]\n    domain_artifacts = [a for a in artifacts if a.get(\"cef\", {}).get(\"destinationDnsDomain\")]\n\n    # Enrich IPs in parallel\n    for artifact in ip_artifacts:\n        ip = artifact[\"cef\"][\"sourceAddress\"]\n\n        # VirusTotal lookup\n        phantom.act(\"ip reputation\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"virustotal_prod\"],\n                    callback=enrich_ip_callback,\n                    name=f\"vt_ip_{ip}\")\n\n        # GeoIP lookup\n        phantom.act(\"geolocate ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"maxmind_prod\"],\n                    callback=geoip_callback,\n                    name=f\"geo_{ip}\")\n\n        # Whois lookup\n        phantom.act(\"whois ip\",\n                    parameters=[{\"ip\": ip}],\n                    assets=[\"whois_prod\"],\n                    name=f\"whois_{ip}\")\n\n    # Enrich domains\n    for artifact in domain_artifacts:\n        domain = artifact[\"cef\"][\"destinationDnsDomain\"]\n        phantom.act(\"domain reputation\",\n                    parameters=[{\"domain\": domain}],\n                    assets=[\"virustotal_prod\"],\n                    name=f\"vt_domain_{domain}\")\n\ndef enrich_ip_callback(action, success, container, results, handle):\n    \"\"\"Update container with enrichment data\"\"\"\n    if success:\n        for result in results:\n            summary = result.get(\"summary\", {})\n            phantom.add_artifact(container, {\n                \"cef\": {\n                    \"vt_malicious\": summary.get(\"malicious\", 0),\n                    \"vt_suspicious\": summary.get(\"suspicious\", 0),\n                    \"enrichment_source\": \"VirusTotal\"\n                },\n                \"label\": \"enrichment\",\n                \"name\": \"VT IP Enrichment\"\n            })\n```\n\n### Step 4: Implement Approval Gates for High-Impact Actions\n\nAdd human-in-the-loop for critical actions:\n\n```python\ndef containment_decision(action, success, container, results, handle):\n    \"\"\"Present analyst with containment options\"\"\"\n    phantom.prompt(\n        container=container,\n        user=\"soc_tier2\",\n        message=(\n            \"Confirmed malicious activity detected.\\n\"\n            f\"Host: {container['artifacts'][0]['cef'].get('sourceAddress')}\\n\"\n            f\"Threat: {results[0]['summary'].get('threat_name')}\\n\\n\"\n            \"Select containment action:\"\n        ),\n        respond_in_mins=15,\n        options=[\"Isolate Host\", \"Disable Account\", \"Both\", \"Monitor Only\"],\n        callback=execute_containment\n    )\n\ndef execute_containment(action, success, container, results, handle):\n    response = results.get(\"response\", \"Monitor Only\")\n\n    if response in [\"Isolate Host\", \"Both\"]:\n        phantom.act(\"quarantine device\",\n                    parameters=[{\"hostname\": container[\"artifacts\"][0][\"cef\"][\"sourceHostName\"]}],\n                    assets=[\"crowdstrike_prod\"],\n                    name=\"isolate_host\")\n\n    if response in [\"Disable Account\", \"Both\"]:\n        phantom.act(\"disable user\",\n                    parameters=[{\"username\": container[\"artifacts\"][0][\"cef\"][\"sourceUserName\"]}],\n                    assets=[\"ad_prod\"],\n                    name=\"disable_account\")\n\n    phantom.comment(container, f\"Analyst approved: {response}\")\n```\n\n### Step 5: Configure Playbook Scheduling and Triggers\n\nSet up event triggers in SOAR:\n\n```json\n{\n  \"playbook_name\": \"phishing_triage_automation\",\n  \"trigger\": {\n    \"type\": \"event_created\",\n    \"conditions\": {\n      \"label\": [\"phishing\", \"notable\"],\n      \"severity\": [\"high\", \"medium\"]\n    }\n  },\n  \"active\": true,\n  \"run_as\": \"automation_user\"\n}\n```\n\n### Step 6: Monitor Playbook Performance\n\nTrack automation effectiveness with SOAR metrics:\n\n```python\n# Query SOAR API for playbook execution stats\nimport requests\n\nheaders = {\"ph-auth-token\": \"YOUR_SOAR_TOKEN\"}\nresponse = requests.get(\n    \"https:\u002F\u002Fsoar.company.com\u002Frest\u002Fplaybook_run\",\n    headers=headers,\n    params={\n        \"page_size\": 100,\n        \"filter\": '{\"status\":\"success\"}',\n        \"sort\": \"create_time\",\n        \"order\": \"desc\"\n    }\n)\nruns = response.json()[\"data\"]\n\n# Calculate automation metrics\ntotal_runs = len(runs)\navg_duration = sum(r[\"end_time\"] - r[\"start_time\"] for r in runs) \u002F total_runs\nauto_closed = sum(1 for r in runs if r.get(\"auto_resolved\"))\nprint(f\"Total runs: {total_runs}\")\nprint(f\"Avg duration: {avg_duration:.1f}s\")\nprint(f\"Auto-resolved: {auto_closed}\u002F{total_runs} ({auto_closed\u002Ftotal_runs*100:.0f}%)\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **SOAR** | Security Orchestration, Automation, and Response — platform integrating security tools with automated playbooks |\n| **Playbook** | Automated workflow defining sequential and parallel actions triggered by security events |\n| **Asset** | SOAR configuration for a connected security tool (API endpoint, credentials, connection parameters) |\n| **Container** | SOAR event object containing artifacts (IOCs) from an ingested alert or incident |\n| **Artifact** | Individual IOC or data point within a container (IP, hash, URL, domain, email) |\n| **Approval Gate** | Human-in-the-loop step requiring analyst decision before executing high-impact automated actions |\n\n## Tools & Systems\n\n- **Splunk SOAR (Phantom)**: Enterprise SOAR platform with 300+ app integrations and visual playbook editor\n- **Splunk ES**: SIEM platform feeding notable events into SOAR as containers for automated triage\n- **CrowdStrike Falcon**: EDR platform integrated via SOAR for automated host isolation and threat hunting\n- **ServiceNow**: ITSM platform integrated for automated incident ticket creation and tracking\n- **Palo Alto NGFW**: Firewall integrated for automated IP\u002FURL blocking via SOAR playbooks\n\n## Common Scenarios\n\n- **Phishing Triage**: Auto-extract URLs\u002Fattachments, detonate in sandbox, block malicious, create ticket\n- **Malware Alert Enrichment**: Auto-enrich file hashes across VT\u002FMalwareBazaar, isolate if confirmed malicious\n- **Brute Force Response**: Auto-check if attack succeeded, disable account if compromised, block source IP\n- **Threat Intel IOC Processing**: Auto-ingest TI feed IOCs, check against internal logs, create blocks for matches\n- **Vulnerability Alert Response**: Auto-query asset database for affected systems, create patching ticket with priority\n\n## Output Format\n\n```\nSOAR PLAYBOOK EXECUTION REPORT\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nPlaybook:     Phishing Triage Automation v2.3\nContainer:    SOAR-2024-08921\nTrigger:      Notable event from Splunk ES (phishing)\n\nActions Executed:\n  [1] URL Reputation (VirusTotal)     — 14\u002F90 engines malicious    [2.1s]\n  [2] IP Reputation (AbuseIPDB)       — Confidence: 85%            [1.3s]\n  [3] Block URL (Palo Alto)           — Blocked on PA-5260         [0.8s]\n  [4] Block IP (Palo Alto)            — Blocked on PA-5260         [0.7s]\n  [5] Create Ticket (ServiceNow)      — INC0012345 created         [1.5s]\n  [6] Prompt Analyst (Tier 2)         — Response: \"Isolate Host\"   [4m 12s]\n  [7] Quarantine Device (CrowdStrike) — WORKSTATION-042 isolated   [3.2s]\n\nTotal Duration:    4m 22s (vs 35min avg manual triage)\nTime Saved:        ~31 minutes\nDisposition:       True Positive — Escalated to IR\n```\n",{"name":5,"tags":49,"author":53,"domain":36,"license":15,"version":54,"category":5,"nist_csf":55,"subdomain":60,"description":7,"mitre_attack":61},[39,24,29,50,26,51,42,52],"splunk-soar","playbook","incident-response","mahipal","1.0",[56,57,58,59],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations",[62,63,64,65],"T1078","T1685.002","T1685.005","T1566","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fimplementing-soar-automation-with-phantom",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill implementing-soar-automation-with-phantom",{"tool":80,"command":81},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill implementing-soar-automation-with-phantom",{"tool":83,"command":84},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill implementing-soar-automation-with-phantom","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-soar-automation-with-phantom\u002FSKILL.md",true,[88,93,99],{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-soar-automation-with-phantom\u002FLICENSE",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"references\u002Fapi-reference.md","REFERENCE","参考文档",2620,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-soar-automation-with-phantom\u002Freferences\u002Fapi-reference.md",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fagent.py","SCRIPT","脚本",9597,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fimplementing-soar-automation-with-phantom\u002Fscripts\u002Fagent.py",[106,132,157,178,193,210],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":115,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[116,117,118,119,120,121,36,122,123,124,52,125,126,30,127,128,129,33,130,131],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","ransomware","detection","t1490","disaster-recovery","restore","disaster recovery","ransomware response",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[139,140,141,142,27,36,143,144,145,146,147,148,149,150,151,152,153,154,155,156],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[164,165,33,36,40,39,166,30,127,167,168,169,170,171,172,173,174,175,176,177],"security","triaging security incident","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[164,51,185,165,33,27,36,186,39,52,187,188,30,127,189,168,152,190,191,192],"triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":199,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[164,200,38,201,202,203,36,204,205,206,39,207,30,35,208,209,171,34,33,32],"security alerts","triaging security alerts in splunk","alerts","review","siem","dashboard","search","correlation-search","notable-events","incident-review",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":216,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[217,218,219,220,36,221,222,223,224,225,226,35,227,228,34,229,32,230,231,232],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]