splunk.es.splunk_response_plan_execution_info module – Gather information about applied response plans on an investigation

Note

This module is part of the splunk.es collection (version 5.1.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install splunk.es.

To use it in a playbook, specify: splunk.es.splunk_response_plan_execution_info.

New in splunk.es 5.1.0

Synopsis

  • This module retrieves information about response plans applied to a Splunk Enterprise Security investigation.

  • Returns the complete structure of applied response plans including phases and task statuses.

  • Use this module to query the current state of response plan execution without making changes.

Note

This module has a corresponding action plugin.

Parameters

Parameter

Comments

api_app

string

The app portion of the Splunk API path.

Override this if your environment uses a different app name.

Default: "missioncontrol"

api_namespace

string

The namespace portion of the Splunk API path.

Override this if your environment uses a different namespace.

Default: "servicesNS"

api_user

string

The user portion of the Splunk API path.

Override this if your environment requires a different user context.

Default: "nobody"

investigation_ref_id

string / required

The investigation UUID to query for applied response plans.

This is the unique identifier of the investigation (incident).

Examples

- name: Get applied response plans for an investigation
  splunk.es.splunk_response_plan_execution_info:
    investigation_ref_id: "590afa9c-23d5-4377-b909-cd2cfa1bc0f1"
  register: result

- name: Display applied response plans
  debug:
    var: result.applied_response_plans

- name: Query with custom API path
  splunk.es.splunk_response_plan_execution_info:
    investigation_ref_id: "590afa9c-23d5-4377-b909-cd2cfa1bc0f1"
    api_namespace: "{{ es_namespace | default('servicesNS') }}"
    api_user: "{{ es_user | default('nobody') }}"
    api_app: "{{ es_app | default('missioncontrol') }}"
  register: custom_result

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

applied_response_plans

list / elements=dictionary

List of response plans applied to the investigation

Returned: always

Sample: [{"description": "Standard incident response procedure", "id": "b9e54dd3-d99c-4a17-bfde-17321d973511", "name": "Incident Response Plan", "phases": [{"id": "1ad365e7-ae1e-4023-99c1-eb58dd11b250", "name": "Investigation Phase", "tasks": [{"description": "Perform initial assessment", "id": "3226b3dc-a31b-4987-b76c-3cdb32135f37", "is_note_required": false, "name": "Initial Triage", "owner": "admin", "status": "started"}, {"description": "Collect relevant logs", "id": "2c73e6c5-35ec-454a-bba0-aa12a3297d56", "is_note_required": false, "name": "Gather Evidence", "owner": "unassigned", "status": "pending"}]}], "source_template_id": "77b3888b-a25e-4def-89fa-071fdcc10e47"}]

description

string

Description of the response plan

Returned: success

id

string

The unique ID of the applied response plan instance

Returned: success

name

string

Name of the response plan

Returned: success

phases

list / elements=dictionary

List of phases in the applied response plan

Returned: success

id

string

The unique ID of the phase

Returned: success

name

string

Name of the phase

Returned: success

tasks

list / elements=dictionary

List of tasks in the phase

Returned: success

description

string

Description of the task

Returned: success

id

string

The unique ID of the task

Returned: success

is_note_required

boolean

Whether a note is required when completing the task

Returned: success

name

string

Name of the task

Returned: success

owner

string

Owner/assignee of the task. Use admin for the administrator user. Use unassigned when no owner is assigned.

Returned: success

status

string

Current status of the task. Values are pending, started, or ended.

Returned: success

source_template_id

string

The ID of the response plan template this was created from

Returned: success

changed

boolean

Always returns false as this is an info module

Returned: always

Sample: false

Authors

  • Ron Gershburg (@rgershbu)