skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-soar-playbook-for-phishing

Automates phishing incident response by creating Splunk SOAR containers, artifacts, and playbook runs via REST API.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#Automation#phishing#security operations#soar#REST api#splunk phantom
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-soar-playbook-for-phishing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-soar-playbook-for-phishing
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/security-operations/implementing-soar-playbook-for-phishing
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-soar-playbook-for-phishing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests.

What problem does it solve?

Manually triaging reported phishing emails is slow and inconsistent. This Skill automates the full incident response workflow: parsing a suspicious .eml file, creating a SOAR container, attaching IOC artifacts, and triggering an investigation playbook through the Splunk SOAR REST API.

Core Features & Use Cases

  • Email Parsing: Extracts headers (From, To, Subject, Return-Path, Message-ID), authentication results (SPF, DKIM, DMARC), URLs, and IP addresses from .eml files.
  • SOAR Container & Artifact Creation: POSTs to /rest/container and /rest/artifact with CEF fields such as fromAddress, sourceAddress, and requestURL, controlling run_automation timing.
  • Playbook Orchestration & Monitoring: Triggers playbooks via /rest/playbook_run and polls /rest/action_run until all actions reach a terminal state, then compiles a verdict report.
  • Use Case: A security analyst receives a reported phishing email, hands the .eml file to the agent, and receives a container ID, playbook run status, and a malicious/benign verdict with flagged indicators.

Quick Start

Parse the attached suspicious-email.eml file, create a Splunk SOAR container with its indicators as artifacts, trigger the phishing_investigate playbook, and report the final verdict.

Frequently Asked Questions about implementing-soar-playbook-for-phishing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate phishing incident response with Splunk SOAR?▼

Parse the .eml file to extract headers, URLs, and IPs, then POST to /rest/container to create an incident, add CEF artifacts via /rest/artifact, and trigger the investigation playbook with /rest/playbook_run. Poll /rest/action_run until all actions reach a terminal state.

How to trigger a Splunk SOAR playbook via REST API?▼

Send a POST to /rest/playbook_run with the playbook ID or name and the target container ID, authenticated with the ph-auth-token header. Alternatively, set run_automation to true on the final artifact POST so the active playbook fires on ingest.

Why is my Splunk SOAR playbook not running after creating artifacts?▼

Common causes are run_automation set to false on every artifact POST, a playbook label that does not match the container label, or the playbook being saved but not active. Verify the label match and confirm a playbook_run_id is returned.

What permissions does the Splunk SOAR API token need?▼

The ph-auth-token must have permissions to create containers and trigger playbooks. A read-only token can create containers but silently fails to start playbooks, so test with a /rest/playbook_run POST and check for a 200 response with a playbook_run_id.

Why do SOAR playbook actions fail even though the playbook runs?▼

Reputation actions fail when the underlying asset, such as a VirusTotal integration, has no API key configured. Poll /rest/action_run and confirm each action reaches success rather than failed to catch these silent asset misconfigurations.

Related Skills

Explore More Software Engineering Skills→
erlebacherlebach

email-forensics

Extract forensic artifacts from PST, OST, MBX, EML, and MSG email files.

Community
Advanced
aashariaashari
5

mail-top-senders

Query local mailbox data with sqlite3 to rank top senders and analyze communication patterns.

Community
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-intelligence-feeds

Normalize threat intelligence feeds into STIX 2.1 indicators.

Community
Advanced
balsm-healthbalsm-health
2

analyzing-email-headers-for-phishing-investigation

Parse email headers and validate SPF, DKIM, and DMARC records.

Official
Advanced