Splunk SOAR: Your success in automation lies within your python abilities

Splunk SOAR's performance is as good as your python scripting and API calling abilities. While the GUI makes things a little easier, anything that doesn't fall inside the box can be problematic. Once designed and tested the playbooks often run without hesitation and reliably provided systems are spec'd properly.

We use Splunk SOAR to automate notification of users of malicious links clicked and to pull malicious emails from mailboxes based on analyst determination. Beyond that, we use Splunk SOAR to automate the isolation of devices determined by EDR to be compromised while enriching the alert data and notifying analysts. In our implementation, we have experienced issues with troubleshooting when part of the python script would fail rather than the playbook or an entire function within the playbook.