SOAR - playbook with phantom.act in a loop inside a custom code block overwhelm the system

Applicability

Description

User found that all SOAR Playbooks Queued when a new playbook started running.

Investigation

In that playbook, there is a custom code block which puts phantom.act in a loop.

    for inner_list in run_query_1_result_item_1:
        for item in inner_list:
            phantom.debug(item["savedsearch_name"])
            phantom.debug(item["earliest"])
            phantom.debug(item["latest"])
            parameters = []
            parameters.append({
                "command": "savedsearch",
                "search_mode": "smart",
                "add_raw_field": True,
                "query": "\""+item["savedsearch_name"]+"\"",
                "start_time": item["earliest"],
                "end_time": item["latest"],
            })
            phantom.act("run query", parameters=parameters, name="run_query_2", assets=["<XXX>"])
    phantom.debug("Looping ends")

phantom.act is asynchronous — it generates an action job and returns immediately. If user place it inside a Python for or while loop in a custom code block, user'll fire off multiple action runs concurrently without waiting for each to complete.This can overwhelm the system and produce unpredictable results.

Resolution

Building the parameter list in the custom code block and then passing it to a downstream Action Block is the recommended pattern.

Step 1 — Custom Code Block (Data Preparation Only)
Build the parameter list in a loop, but do not call phantom.act directly. The custom code block is solely responsible for constructing the list of parameter.

    code_1__query_list = []
    for inner_list in run_query_1_result_item_1:
        for item in inner_list:
            phantom.debug(item["savedsearch_name"])
            phantom.debug(item["earliest"])
            phantom.debug(item["latest"])
            query_string = f'| savedsearch "{item['savedsearch_name']}" earliest={item['earliest']} latest={item['latest']}'
            # Append the constructed string to the results list
            code_1__query_list.append(query_string)
    phantom.debug("Looping ends")

Step 2 — Utility Block: list_demux (List Demultiplexer)
The raw Python list from the custom code block cannot be directly consumed by an Action Block. Pass it through the list_demux utility block, which fans out the list into the specific format that Action Blocks expect for their input spec.

Step 3 — Action Block (Execution)
The demuxed output from list_demux is used as the input parameter for the downstream Action Block. SOAR handles the execution with proper concurrency controls, async callbacks, and rate limiting.