Set container parameters in Splunk SOAR (On-premises) using the API block with the classic playbook editor

Use the API block to set parameters of the container it's running in. For example, you can use an API call to set the severity of a container.

Perform the following tasks to configure an API block:

  1. Drop a new block onto the playbook editor.
  2. Click on the block, and then select API from the block types.
  3. Select the API property you want to set. The following table summarizes the properties that you can set:
    Property Description
    labelThe label of the container. The drop-down list shows all of the container labels currently available on your Splunk SOAR (On-premises) instance.
    sensitivityThe sensitivity of the container.
    severityThe severity of the container.
    statusThe status of the container, such as Resolved.
    ownerThe owner of the container.
    add listOne of two API calls that doesn't operate directly on the container. The add list property takes two parameters: the list that you want to add to, and the data you are adding. If the list doesn't exist, it is created by Splunk SOAR (On-premises). You can point the data field to a variable by selecting from the properties, results, and artifacts, or you can type in a fixed string.
    remove listOne of two API calls that doesn't operate directly on the container. The remove list property takes a list name as the single parameter, and deletes that list when it has run.
    pinPin data to the heads-up display (HUD) in the container. This property takes the following parameters:
    • Data
    • Message
    • Pin Type
    • Pin Style
    add tagThe API call used to add a tag to the container.
    remove tagThe API call to remove a tag from the container.
    add commentThe API call used to add a comment to a container. You can either supply a variable or a static string in the input.
    promote to caseThe API call used to promote the container to a case. It takes a single parameter, the case template you can pick from a drop-down list.
    add noteThe API call used to add a note. It takes the parameters title, content, and note format. With the note format parameter, you can choose either HTML or Markdown.
    You can configure multiple API calls in any API block. For example, you can set the label, severity, and status of a container using one API block.
  4. Click Save to save the settings. A check mark appears next to the API calls that you configured.