___ _             _                 _   ___ ___    ___ _ _         _   
| _ \ |_  __ _ _ _| |_ ___ _ __     /_\ | _ \_ _|  / __| (_)___ _ _| |_ 
|  _/ ' \/ _` | ' \  _/ _ \ '  \   / _ \|  _/| |  | (__| | / -_) ' \  _|
|_| |_||_\__,_|_||_\__\___/_|_|_| /_/ \_\_| |___|  \___|_|_\___|_||_\__|

Client library for Phantom's REST API.

Developed for use with Phantom v4.5+, however, most functionality *should work with previous versions.

Developed for use with Python3.8+, however, it should work with 3.6/7+. There is no guarantee that future development won't utilize 3.8+ specifc syntax.

*Not Affiliated with Splunk or Phantom

pip install phantom-api-client

This modules primary use-case is inheritance from other REST API clients.

• Actions:
  • Run Action
  • Cancel Running Action
• Aggregation Rules:
  • Create Rule
  • Update Rule
  • Delete Rule
• Apps:
  • Install App
• Artifacts: (16/16) 100.0%
  • Get All Artifacts Count
  • Get All Artifacts Count Filtered
  • Get One Container Artifacts Count
  • Get One Artifact
  • Get All Artifacts
  • Get All Artifacts Filtered
  • Get All Artifacts Date-Filtered
  • Get All Container Artifacts
  • Get All Container Artifacts Date-Filtered
  • Create One Artifact
  • Create Many Artifacts
  • Update One Artifact
  • Update Many Artifacts
  • Delete One Artifact
  • Delete Many Artifacts
  • Delete All Container Artifacts
• Assets:
  • Create Assets
• Attachments:
  • Get Attachment
  • Get Attachments
  • Create Attachment
  • Delete Attachment
• Audit:
  • Get One User Audit Data
  • Get Many Users Audit Data
  • Get One Role Audit Data
  • Get Many Role Audit Data
  • Get Authentication Audit Data
  • Get Administration Audit Data
  • Get One Playbook Audit Data
  • Get Many Playbooks Audit Data
  • Get One Container Audit Data
  • Get Many Containers Audit Data
  • Get All Audit Data
• CEF:
  • Get Available CEFs
  • Create Custom CEF
  • Get Custom CEFs
  • Get Custom CEF
  • Update Custom CEF
  • Delete Custom CEF
• Clustering:
  • Get Nodes
• Containers: (16/16) 100%
  • Get All Containers Count
  • Get All Containers Count Filtered
  • Get All Containers
  • Get All Containers Filtered
  • Get All Containers Date Filtered (Custom Date Filtering)
  • Get One Container
  • Get One Container Whitelist Users
  • Get One Container Whitelist Candidates
  • Get One Container Phases
  • Get Many Containers
  • Create One Container
  • Create Many Containers
  • Update One Container
  • Update Many Containers
  • Delete One Container
  • Delete Many Containers
• Custom Lists:
  • Get List
  • Create List
  • Update List
  • Delete List
• Evidence:
  • Get Container Evidence
  • Create Container Evidence
  • Delete Container Evidence
• HUD:
  • Pin Container
  • Update Pin
• Indicators:
  • Get Indicator Counts
  • Get Top Event Labels
  • Get Top Indicator Types
  • Get Top Indicator Values
  • Get Indicators
  • Get Indicator
  • Get Artifacts by Indicator
  • Get Indicator Timeline by Value
  • Get Containers by Indicator
• Informational:
  • Get Version
  • Get System Info
  • Get License
  • Get System Health
  • Get App Status Info
  • Get Widget Info
• Notes:
  • Create Container Note
  • Create Containers Notes
  • Create Artifact Note
  • Create Task Note
  • Update Container Note
  • Get Container Notes
  • Get Container Note
  • Delete Note
  • Get Artifact Notes
  • Get Task Notes
  • Search Notes
• Playbooks:
  • Update Playbook Status
  • Run Playbook
  • Cancel Running Playbook
  • Update Source Control Repository
• Search:
  • Run Search
• Severity:
  • Get Severity's
  • Create Severity
  • Delete Severity
  • Update Severity
• Status:
  • Get Status Labels
  • Create Status Label
  • Delete Status Label
• System Settings:
  • Update System Settings
• Tenants:
  • Create Tenant
  • Update Tenant
• Users:
  • Get Users Count
  • Get All Users
  • Get One User
  • Create One User
  • Update One User
  • Delete One User
  • Create Role/Permissions
• Workbooks (formerly known as Case Templates):
  • Create Case Workflow Template
  • Create Phase Object
  • Create Task Object
  • Add Phase Template to Workflow Template
  • Add Task to Phase Template
  • Get Workbook Phases

Phantom v4.2.7532 | Intel(R) Xeon(R) CPU E7-8860 v4 @ 2.20GHz (8 Cores VMWare) | 32GB RAM

No Pretty or Expensive

More than 100 simultaneous connections/queries results in missing records.

GitHub Pages

• Work in Process

Mass deleting records quits early with timeout error. It would seem the more records that are being deleted adds an exponential increase in wait between deletes. So far in testing >= 47 (254) 114 at once results in timeout-error.

Phantom v4.2 and earlier has completely broken pagination. You will receive duplicate and missing records. You should set the query filter 'page_size' to a number greater than the max expected results in order to receive all records in a single page.

Copyright © 2019 Jerod Gawne https://github.com/jerodg/

This program is free software: you can redistribute it and/or modify it under the terms of the Server Side Public License (SSPL) as published by MongoDB, Inc., either version 1 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the SSPL for more details.

You should have received a copy of the SSPL along with this program. If not, see https://www.mongodb.com/licensing/server-side-public-license.