In Splunk SOAR playbooks, the blocks that can discern which path to take next are the prompt and decision blocks. The prompt block allows the playbook to pause and wait for user input, which can then determine the subsequent path of execution based on the response provided. The decision block evaluates conditions based on data within the playbook and directs the flow to different paths accordingly11.
The decision block is used to change the flow of artifacts by performing IF, ELSE IF, or ELSE functions. When an artifact meets a True condition, it is passed downstream to the corresponding block in the playbook flow11. The prompt block, on the other hand, interacts with users to make decisions during playbook execution, which can also influence the direction of the playbookâs flow.
References:
Splunk SOAR documentation on using decisions to send artifacts to a specific downstream action in your playbook
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit