SOAR - playbook prompt failed

Applicability

Description

The prompt block failed with the following error:

phantom.act(): 'prompt_1' has an invalid 'to' parameter value. Could not find 'test_role' in users or roles.

Investigation

There are duplicate IDs for the same role name "test_role" in the table "role" and some of them are disabled.

phantom=# select id,name,disabled from role where name='test_role';
id | name | disabled
-----+--------------------------------------------+----------
9 | test_role | t
18 | test_role | t
63 | test_role | t
105 | test_role | f

It was found out when the "test_role" is deleted from the Administration->User Management->Roles&Permissions web page. SOAR marked it as disabled in the table and the role would disappear from GUI. However, when recreating a custom role with the same name, a duplicate entry was created in the table. This resulted in prompt block failure when running the playbook because SOAR queried the table and got the record where the role was marked as disabled.

Resolution

A workaround is to delete the entries of the role where the disabled column is set as "t" in the table "role". After it, the prompt block worked running the playbook.

In the above example, deleting those three records:

phantom=# select id,name,disabled from role where name='test_role';
id | name | disabled
-----+--------------------------------------------+----------
9 | test_role | t
18 | test_role | t
63 | test_role | t