SOAR - How to avoid playbook failing when there is no new artifact

Applicability

Description

A playbook is configured to run automatically when Artifact created. It is observed that when multiple events come in at the same time and new artifacts being created, the playbook has failed intermittently since automation is enabled.

Investigation

In this example, three playbook automation runs were initiated almost at the same time. The playbook run failed in one action using an input parameter from the "artifact:*.cef.incidentId". The three playbook run ids: 774462, 774463, 774464.

The run id 774462 ran successfully and got incident_id from two artifacts: 666132 and 666134.

{"time":"2024-04-24T21:06:40.171530","component":..."ctx_container_id":"460560",.."ctx_playbookrun_id":"774462",..."message":"Command Params JSON: [\n\t{\n\t\t\"context\" : \n\t\t{\n\t\t\t\"artifact_id\" : 666132,\n\t\t\t\"guid\" : \"457129b4-2a62-43f8-8c13-6a59baabb0a9\"\n\t\t},\n\t\t\"incident_id\" : \"********\"\n\t},\n\t{\n\t\t\"context\" : \n\t\t{\n\t\t\t\"artifact_id\" : 666134,\n\t\t\t\"guid\" : \"f666c574-e431-4950-8d5e-3389b1e5e153\"\n\t\t},\n\t\t\"incident_id\" : \"********\"\n\t}\n]\n, required_param: incident_id","pid":2671860,"product_version":"6.2.1.305","tid":2671860}

The run id 774463 ran successfully and got incident_id from artifact 666136.

{"time":"2024-04-24T21:06:41.507102","component":"LIBDATASTORE",..."ctx_container_id":"460560",...,"ctx_playbookrun_id":"774463",...,"file":"/srv/phantom/alchemy/libpgdatastore/app_ex.cpp","level":"DEBUG","line":693,"message":"Command Params JSON: [\n\t{\n\t\t\"context\" : \n\t\t{\n\t\t\t\"artifact_id\" : 666136,\n\t\t\t\"guid\" : \"7033b214-3c00-4fd5-8f23-196e41d2e200\"\n\t\t},\n\t\

The run id 774464 failed because there is nothing in the input artifact.*incidentId since the playbook is running with zero artifact.

{"time":"2024-04-24T21:06:42.410289","component":"DECIDED",...,"ctx_container_id":"460560",...,"ctx_playbookrun_id":"774464",...,"message":.... Error: The ... action requires the following parameters: incident_id. The given parameters look like they were automatically generated by phantom.act() because an empty parameters list was passed to phantom.act(). The parameters list may have been empty because the preceding call to phantom.collect2() returned an empty list. Check your calling code in the action that generated this error, Params: [{\"context\": {\"artifact_id\": 0, \"parent_action_run\": [], \"guid\": \"fbfe3616-9e9f-4da8-a84e-6fe044092c8d\"}}]"

Resolution

This is a limitation of playbook dispatch in current SOAR design and would require engineering work to fix. 

As a workaround, in order to avoid running the playbook further in case there is zero artifact, adding a Code node right after Start node to check if there is any new artifact. Here is the sample code:

@phantom.playbook_block()
def artifact_count(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs):
    phantom.debug("artifact_count() called")    artifact_count__artifact_count = None    ################################################################################
    ## Custom Code Start
    ################################################################################    artifact_count__artifact_count = len(phantom.collect2(container=container, datapath=["artifact:*.cef.incidentId","artifact:*.id"]))    ################################################################################
    ## Custom Code End
    ################################################################################    phantom.save_run_data(key="artifact_count:artifact_count", value=json.dumps(artifact_count__artifact_count))    decision_2(container=container)    return

After it, using a Decision node. When there is zero new artifact, the playbook can end immediately. If there is new artifact, the playbook can proceed with the subsequent workflow.