Skip to content

Commit a4d9d09

Browse files
aplunkaplunk
committed
feat: Add action.sendtophantom for splunk_saved_searches
1 parent e8397ea commit a4d9d09

File tree

4 files changed

+156
-1
lines changed

4 files changed

+156
-1
lines changed

‎client/models/saved_searches.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,16 @@ type SavedSearchObject struct {
118118
ActionJiraServiceDeskParamJiraPriority string `json:"action.jira_service_desk.param.jira_priority,omitempty" url:"action.jira_service_desk.param.jira_priority"`
119119
ActionJiraServiceDeskParamJiraDescription string `json:"action.jira_service_desk.param.jira_description,omitempty" url:"action.jira_service_desk.param.jira_description"`
120120
ActionJiraServiceDeskParamJiraCustomfields string `json:"action.jira_service_desk.param.jira_customfields,omitempty" url:"action.jira_service_desk.param.jira_customfields"`
121+
ActionSendToPhantom string `json:"action.sendtophantom,omitempty" url:"action.sendtophantom"`
122+
ActionSendToPhantomParamPhantomServer string `json:"action.sendtophantom.param.phantom_server,omitempty" url:"action.sendtophantom.param.phantom_server"`
123+
ActionSendToPhantomParamServerPlaybookName string `json:"action.sendtophantom.param.server_playbook_name,omitempty" url:"action.sendtophantom.param.server_playbook_name"`
124+
ActionSendToPhantomParamSeverity string `json:"action.sendtophantom.param.severity,omitempty" url:"action.sendtophantom.param.severity"`
125+
ActionSendToPhantomParamSensitivity string `json:"action.sendtophantom.param.sensitivity,omitempty" url:"action.sendtophantom.param.sensitivity"`
126+
ActionSendToPhantomParamLabel string `json:"action.sendtophantom.param.label,omitempty" url:"action.sendtophantom.param.label"`
127+
ActionSendToPhantomParamGrouping string `json:"action.sendtophantom.param.grouping,omitempty" url:"action.sendtophantom.param.grouping"`
128+
ActionSendToPhantomParamRelayAccount string `json:"action.sendtophantom.param.relay_account,omitempty" url:"action.sendtophantom.param.relay_account"`
129+
ActionSendToPhantomParamContainerName string `json:"action.sendtophantom.param.container_name,omitempty" url:"action.sendtophantom.param.container_name"`
130+
ActionSendToPhantomParam_CamWorkers string `json:"action.sendtophantom.param._cam_workers,omitempty" url:"action.sendtophantom.param._cam_workers"`
121131
ActionWebhookParamUrl string `json:"action.webhook.param.url,omitempty" url:"action.webhook.param.url"`
122132
AlertDigestMode bool `json:"alert.digest_mode" url:"alert.digest_mode"`
123133
AlertExpires string `json:"alert.expires,omitempty" url:"alert.expires,omitempty"`

‎splunk/resource_splunk_configs_conf_test.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ func TestAccCreateSplunkConfigsConfSpecialChars(t *testing.T) {
112112
})
113113
}
114114

115-
116115
func testAccSplunkConfigsConfDestroyResources(s *terraform.State) error {
117116
client, err := newTestClient()
118117
if err != nil {

‎splunk/resource_splunk_saved_searches.go‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,6 +695,56 @@ func savedSearches() *schema.Resource {
695695
Description: "URL to send the HTTP POST request to. Must be accessible from the Splunk server.",
696696
ValidateFunc: validation.StringMatch(regexp.MustCompile(`^https?://[^\s]+$`), "Webhook URL is invalid"),
697697
},
698+
"action_sendtophantom": {
699+
Type: schema.TypeString,
700+
Optional: true,
701+
Description: "Enable the send to phantom action (https://docs.splunk.com/Documentation/SOARExport/4.3.13/UserGuide/Adaptiveresponseactions#Send_to_SOAR_request).",
702+
},
703+
"action_sendtophantom_param_phantom_server": {
704+
Type: schema.TypeString,
705+
Optional: true,
706+
Description: "The phantom server.",
707+
},
708+
"action_sendtophantom_param_server_playbook_name": {
709+
Type: schema.TypeString,
710+
Optional: true,
711+
Description: "server_playbook_name",
712+
},
713+
"action_sendtophantom_param_severity": {
714+
Type: schema.TypeString,
715+
Optional: true,
716+
Description: "Alert severity.",
717+
},
718+
"action_sendtophantom_param_sensitivity": {
719+
Type: schema.TypeString,
720+
Optional: true,
721+
Description: "Alert sensitivity.",
722+
},
723+
"action_sendtophantom_param_label": {
724+
Type: schema.TypeString,
725+
Optional: true,
726+
Description: "Alert label.",
727+
},
728+
"action_sendtophantom_param_grouping": {
729+
Type: schema.TypeString,
730+
Optional: true,
731+
Description: "Alert grouping.",
732+
},
733+
"action_sendtophantom_param_relay_account": {
734+
Type: schema.TypeString,
735+
Optional: true,
736+
Description: "relay_account (the Alert Action Account).",
737+
},
738+
"action_sendtophantom_param_container_name": {
739+
Type: schema.TypeString,
740+
Optional: true,
741+
Description: "search_name (default) or source.",
742+
},
743+
"action_sendtophantom_param_cam_workers": {
744+
Type: schema.TypeString,
745+
Optional: true,
746+
Description: "Adaptive response relay worker, use [\"local\"] if running locally.",
747+
},
698748
"alert_digest_mode": {
699749
Type: schema.TypeBool,
700750
Optional: true,
@@ -1495,6 +1545,36 @@ func savedSearchesRead(d *schema.ResourceData, meta interface{}) error {
14951545
if err = d.Set("action_jira_service_desk_param_jira_customfields", entry.Content.ActionJiraServiceDeskParamJiraCustomfields); err != nil {
14961546
return err
14971547
}
1548+
if err = d.Set("action_sendtophantom", entry.Content.ActionSendToPhantom); err != nil {
1549+
return err
1550+
}
1551+
if err = d.Set("action_sendtophantom_param_phantom_server", entry.Content.ActionSendToPhantomParamPhantomServer); err != nil {
1552+
return err
1553+
}
1554+
if err = d.Set("action_sendtophantom_param_server_playbook_name", entry.Content.ActionSendToPhantomParamServerPlaybookName); err != nil {
1555+
return err
1556+
}
1557+
if err = d.Set("action_sendtophantom_param_severity", entry.Content.ActionSendToPhantomParamSeverity); err != nil {
1558+
return err
1559+
}
1560+
if err = d.Set("action_sendtophantom_param_sensitivity", entry.Content.ActionSendToPhantomParamSensitivity); err != nil {
1561+
return err
1562+
}
1563+
if err = d.Set("action_sendtophantom_param_label", entry.Content.ActionSendToPhantomParamLabel); err != nil {
1564+
return err
1565+
}
1566+
if err = d.Set("action_sendtophantom_param_grouping", entry.Content.ActionSendToPhantomParamGrouping); err != nil {
1567+
return err
1568+
}
1569+
if err = d.Set("action_sendtophantom_param_relay_account", entry.Content.ActionSendToPhantomParamRelayAccount); err != nil {
1570+
return err
1571+
}
1572+
if err = d.Set("action_sendtophantom_param_container_name", entry.Content.ActionSendToPhantomParamContainerName); err != nil {
1573+
return err
1574+
}
1575+
if err = d.Set("action_sendtophantom_param_cam_workers", entry.Content.ActionSendToPhantomParam_CamWorkers); err != nil {
1576+
return err
1577+
}
14981578
if err = d.Set("action_webhook_param_url", entry.Content.ActionWebhookParamUrl); err != nil {
14991579
return err
15001580
}
@@ -1837,6 +1917,16 @@ func getSavedSearchesConfig(d *schema.ResourceData) (savedSearchesObj *models.Sa
18371917
ActionJiraServiceDeskParamJiraPriority: d.Get("action_jira_service_desk_param_jira_priority").(string),
18381918
ActionJiraServiceDeskParamJiraDescription: d.Get("action_jira_service_desk_param_jira_description").(string),
18391919
ActionJiraServiceDeskParamJiraCustomfields: d.Get("action_jira_service_desk_param_jira_customfields").(string),
1920+
ActionSendToPhantom: d.Get("action_sendtophantom").(string),
1921+
ActionSendToPhantomParamPhantomServer: d.Get("action_sendtophantom_param_phantom_server").(string),
1922+
ActionSendToPhantomParamServerPlaybookName: d.Get("action_sendtophantom_param_server_playbook_name").(string),
1923+
ActionSendToPhantomParamSeverity: d.Get("action_sendtophantom_param_severity").(string),
1924+
ActionSendToPhantomParamSensitivity: d.Get("action_sendtophantom_param_sensitivity").(string),
1925+
ActionSendToPhantomParamLabel: d.Get("action_sendtophantom_param_label").(string),
1926+
ActionSendToPhantomParamGrouping: d.Get("action_sendtophantom_param_grouping").(string),
1927+
ActionSendToPhantomParamRelayAccount: d.Get("action_sendtophantom_param_relay_account").(string),
1928+
ActionSendToPhantomParamContainerName: d.Get("action_sendtophantom_param_container_name").(string),
1929+
ActionSendToPhantomParam_CamWorkers: d.Get("action_sendtophantom_param_cam_workers").(string),
18401930
ActionWebhookParamUrl: d.Get("action_webhook_param_url").(string),
18411931
AlertComparator: d.Get("alert_comparator").(string),
18421932
AlertCondition: d.Get("alert_condition").(string),

‎splunk/resource_splunk_saved_searches_test.go‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,34 @@ resource "splunk_saved_searches" "test" {
284284
}
285285
`
286286

287+
const newSavedSearchesSendToPhantom = `
288+
resource "splunk_saved_searches" "test" {
289+
name = "Test Phantom Alert"
290+
actions = "sendtophantom"
291+
action_sendtophantom = "1"
292+
action_sendtophantom_param_phantom_server = "test_phantom_server"
293+
action_sendtophantom_param_server_playbook_name = "test_playbook"
294+
action_sendtophantom_param_severity = "high"
295+
action_sendtophantom_param_sensitivity = "amber"
296+
action_sendtophantom_param_label = "test"
297+
action_sendtophantom_param_grouping = "1"
298+
action_sendtophantom_param_relay_account = "test_relay_account"
299+
action_sendtophantom_param_container_name = "default"
300+
action_sendtophantom_param_cam_workers = "[\"local\"]"
301+
alert_comparator = "greater than"
302+
alert_digest_mode = true
303+
alert_expires = "30d"
304+
alert_threshold = "0"
305+
alert_type = "number of events"
306+
cron_schedule = "*/1 * * * *"
307+
disabled = false
308+
is_scheduled = true
309+
is_visible = true
310+
realtime_schedule = true
311+
search = "index=main level=error"
312+
}
313+
`
314+
287315
func TestAccSplunkSavedSearches(t *testing.T) {
288316
resourceName := "splunk_saved_searches.test"
289317
resource.Test(t, resource.TestCase{
@@ -423,6 +451,34 @@ func TestAccSplunkSavedSearches(t *testing.T) {
423451
resource.TestCheckResourceAttr(resourceName, "search", "index=main level=error"),
424452
),
425453
},
454+
{
455+
Config: newSavedSearchesSendToPhantom,
456+
Check: resource.ComposeTestCheckFunc(
457+
resource.TestCheckResourceAttr(resourceName, "name", "Test Phantom Alert"),
458+
resource.TestCheckResourceAttr(resourceName, "actions", "sendtophantom"),
459+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom", "1"),
460+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_phantom_server", "test_phantom_server"),
461+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_server_playbook_name", "test_playbook"),
462+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_severity", "high"),
463+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_sensitivity", "amber"),
464+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_label", "test"),
465+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_grouping", "1"),
466+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_relay_account", "test_relay_account"),
467+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_container_name", "default"),
468+
resource.TestCheckResourceAttr(resourceName, "action_sendtophantom_param_cam_workers", "[\"local\"]"),
469+
resource.TestCheckResourceAttr(resourceName, "alert_comparator", "greater than"),
470+
resource.TestCheckResourceAttr(resourceName, "alert_digest_mode", "true"),
471+
resource.TestCheckResourceAttr(resourceName, "alert_expires", "30d"),
472+
resource.TestCheckResourceAttr(resourceName, "alert_threshold", "0"),
473+
resource.TestCheckResourceAttr(resourceName, "alert_type", "number of events"),
474+
resource.TestCheckResourceAttr(resourceName, "cron_schedule", "*/1 * * * *"),
475+
resource.TestCheckResourceAttr(resourceName, "disabled", "false"),
476+
resource.TestCheckResourceAttr(resourceName, "is_scheduled", "true"),
477+
resource.TestCheckResourceAttr(resourceName, "is_visible", "true"),
478+
resource.TestCheckResourceAttr(resourceName, "realtime_schedule", "true"),
479+
resource.TestCheckResourceAttr(resourceName, "search", "index=main level=error"),
480+
),
481+
},
426482
{
427483
Config: newSavedSearchesSlack,
428484
Check: resource.ComposeTestCheckFunc(

0 commit comments

Comments
 (0)