Splunk soar
Splunk SOAR — all tasks. Trigger for: SOAR playbooks, custom Python actions, phantom.act(), phantom.debug(), phantom.error(), decision blocks, action results, custom functions, REST API integration, SOAR assets, custom lists, playbook idempotency, SOAR automation, container, artifact, vault, HUD. Default: Splunk SOAR (Phantom) latest, Python 3.x.From its SKILL.md
npx -y skills add cmwema/splunk-expert --skill splunk-soarAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.4 KB, as published. Nobody here has run it
Splunk SOAR
Router only. Read references/soar.md for all SOAR tasks.
Routing
| Task | Action |
|---|---|
| Any SOAR task — playbooks, Python actions, assets, integrations | Read references/soar.md |
Shared conventions
- Write idempotent playbooks — every action must handle re-runs without duplicate side effects.
- Always wrap custom Python in
try/exceptwith meaningful errors logged viaphantom.error(). - Use decision blocks to handle action failures explicitly — don't let failures silently pass through.
- Parameterize all endpoints, credentials, and thresholds via SOAR custom lists or asset configuration.
phantom.debug()during development; gate behind a debug flag in production.- Least-privilege: SOAR assets only get the permissions required for their specific actions.
- Never
verify=Falseon outbound REST calls in production.
Output format
Fenced python for playbook code. Full functions with try/except. ⚠️ Best Practice callouts. Flag idempotency and credential handling implications.