메뉴
Automate phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger playbooks
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/xalgord/xalgorix --skill implementing-soar-playbook-for-phishing명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
SKILL.md 표시 중
SOC 직업 분류 기준
| name | implementing-soar-playbook-for-phishing |
| description | Automate phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger playbooks |
| domain | cybersecurity |
| subdomain | security-operations |
| tags | ["soar","splunk-phantom","phishing","incident-response"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"] |
This skill implements a phishing incident response workflow using the Splunk SOAR (formerly Phantom) REST API. When a suspected phishing email is reported, the agent parses email headers and body, creates a SOAR container representing the incident, attaches artifacts containing indicators of compromise (sender address, URLs, IP addresses, file hashes), triggers an automated investigation playbook, and polls for action results.
Splunk SOAR orchestrates and automates security operations through playbooks that chain together investigative and response actions. The REST API at /rest/container, /rest/artifact, and /rest/playbook_run enables programmatic incident creation and automation triggering from external tools, email gateways, and SIEM alerts.
/rest/artifact POST sets run_automation: false (including the last one), the active playbook never triggers on ingest. Set run_automation: true on the final artifact, or start it explicitly via /rest/playbook_run.label never fires. Confirm the container label matches the playbook's configured label and that the playbook is active, not just saved.ph-auth-token creates containers fine but silently fails to start playbooks. Verify with a /rest/playbook_run POST and check for a 200 plus a playbook_run_id, not just successful container creation./rest/action_run and confirm each action reaches success, not failed..eml, then verify a container was created, the playbook reached a terminal , and the verdict/artifacts populated. A created container with no is a silent failure.successplaybook_runrequests and email modulesParse the phishing email: Read the email file (.eml format) and extract headers including From, To, Subject, Reply-To, Return-Path, Received, Message-ID, X-Mailer, and authentication results (SPF, DKIM, DMARC). Extract URLs and IP addresses from the email body.
Authenticate to SOAR REST API: Use the API token in the ph-auth-token header to authenticate all REST API requests to the SOAR instance.
Create a container: POST to /rest/container with the incident label, name, description, severity, and status. The container represents the phishing incident and receives a container ID in the response.
Add email header artifacts: POST to /rest/artifact with container_id and CEF (Common Event Format) fields containing sender address (fromAddress), recipient (toAddress), subject, originating IP (sourceAddress), and Message-ID. Set run_automation to False for all but the last artifact.
Add URL artifacts: For each URL extracted from the email body, create an artifact with CEF field requestURL and type url. These artifacts feed into URL reputation checks in the playbook.
Trigger the playbook: POST to /rest/playbook_run with the playbook ID or name and the container ID. This initiates the automated investigation workflow.
Poll action results: GET /rest/action_run filtered by container ID to monitor playbook progress. Poll until all actions reach a terminal state (success, failed, or cancelled).
Compile response report: Aggregate playbook action results into a summary report with verdicts from URL reputation, domain reputation, IP geolocation, and email header analysis.
{
"incident": {
"container_id": 1542,
"status": "new",
"severity": "high",
"artifacts_created": 5
},
"playbook": {
"name": "phishing_investigate",
"run_id": 892,
"status": "success",
"actions_completed": 8
},
"verdict": "malicious",
"indicators": {
"sender_domain_reputation": "malicious",
"urls_flagged": 2,
"spf_result": "fail",
"dkim_result": "fail"
}
}