Sending User Defined Variables to Action Block

[ma620k]

I am new to Splunk SOAR and I have a custom python code block that I am creating and exporting a variable to a Splunk action block.

The variable in the custom code block is set fine and with debug statements I can see it set correctly.  I then export that variable.

In the splunk action block , I import that variable but when I try to use it the value is set to "None".  When I import soar system variables, it works fine.

There are no error messages.  SOAR has the auto fill for the variables so not like I have a typo.

Screen shot below {0} is my customer code variable that gets set to none.

{1} is from the extract ip utility and that is set fine.

[PrewinThomas]

@ma620k 
Did you defined as an output variable in the custom code block’s configuration?

Your variable likely not being exported due to this.

Reference - https://docs.splunk.com/Documentation/SOARonprem/6.3.1/Playbook/CustomFunction

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos. Thanks!

[marnall]

It seems that you are not using {0} in your query input.

Also can you post the sanitized code for the code block and the full entry for the data path of the 0 input?

[ma620k]

Thank you for the responses.  I copy/pasted some of the SOAR info below and as for the questions:

• I did define the output variable in the custom code block config
• I am not using {0} in the sample block because it kept giving an error .  I was using {1} because that was grabbing the IP through a utility and that was working for me.
• The variable from the custom code block (extracted_ip_1) worked fine within the code block but was not set outside of it.
• code_3:customer_function:extraced_ip_1

def code_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):

    phantom.debug("code_3() called")

    regex_extract_ipv4_3__result = phantom.collect2(container=container, datapath=["regex_extract_ipv4_3:custom_function_result.data.extracted_ipv4","regex_extract_ipv4_3:custom_function_result.data.input_value"])

    container_artifact_data = phantom.collect2(container=container, datapath=["artifact:*.cef.cs1","artifact:*.cef.cs1Label"])

    regex_extract_ipv4_3_data_extracted_ipv4 = [item[0] for item in regex_extract_ipv4_3__result]

    regex_extract_ipv4_3_data_input_value = [item[1] for item in regex_extract_ipv4_3__result]

    container_artifact_cef_item_0 = [item[0] for item in container_artifact_data]

    container_artifact_cef_item_1 = [item[1] for item in container_artifact_data]

    input_parameter_0 = ""

    code_3__extracted_ip_1 = None

    ################################################################################

    ## Custom Code Start

    ################################################################################

   # Write your custom code here...

    extracted_ip_1 = regex_extract_ipv4_3_data_extracted_ipv4[0]

   ################################################################################

    ## Custom Code End

    ################################################################################

    phantom.save_run_data(key="code_3:extracted_ip_1", value=json.dumps(code_3__extracted_ip_1))

    run_query_4(container=container)

    return

[marnall · Accepted solution]

Ah there's your problem. You assign the variable "extracted_ip_1" which then works fine within the function, but in the following phantom.save_run_data function call, it does not actually dump the value of the "extracted_ip_1" variable into the output, but rather the "code_3__extracted_ip_1" variable, which is previously set to None.

You should change the phantom.save_run_data command to use the correct variable name in the value parameter:

phantom.save_run_data(key="code_3:extracted_ip_1", value=json.dumps(extracted_ip_1))

Or, if you want to constrain all custom code between the "custom code" comment blocks, you can change the variable name:

code_3__extracted_ip_1 = regex_extract_ipv4_3_data_extracted_ipv4[0]

Also you mentioned your data path on the input to the following block is "code_3:customer_function:extraced_ip_1", which has "customer_function" but it should have "custom_function". Not sure if this is just a typo in your post but if it exists also in your SOAR instance then it can also cause problems.

[ma620k]

Ah that all makes sense.  Thanks so much for the help.   Can't wait to try it.

Yep, that did the trick.  Thank you so much!  And yeah "customer" was just a typo on my part.