Skip to main content

​
What Cymph uses it for

Cymph connects to Splunk SOAR to browse and import the playbooks already on your instance, so existing automation can be brought into Cymph. See Import a playbook. All operations are currently read-only — Cymph never creates, modifies, or runs a playbook on the instance.
Deploying playbooks to Splunk SOAR is not yet available. See Limitations.

​
Requirements

​
Token setup

Cymph authenticates with a ph-auth-token header, which takes a Splunk SOAR automation user token rather than a password.
  1. Create (or choose) an automation user: Administration → User Management → Users, with user type Automation.
  2. Copy the token generated for that user.
  3. Give the automation user a role with read access to playbooks.
Automation users exist for exactly this purpose — they are non-interactive and their activity is easy to separate from human analysts in the audit log. Do not use a personal account’s token.

​
Permissions

The token inherits the role of the automation user it belongs to. Splunk SOAR exposes three permission types on the Playbooks resource — view, edit, and execute — and Cymph needs only the first:
The default Automation role has a broad set of permissions — it is designed to cover whatever a service account might need. For least privilege, create a custom role with only Playbooks → view and assign that to the automation user instead.
Splunk SOAR roles can also be restricted to whitelisted repositories. If you use that, make sure the role can reach the repositories holding the playbooks you want to import — Cymph reads the source-control repository list to disambiguate playbooks that share a name.

​
What Cymph reads

Playbooks can be addressed either by their numeric ID or as {repository_id}/{playbook_name} — Cymph resolves the repository from the source-control list so playbooks with the same name in different repositories stay distinct.

​
Testing the connection

Test Connection calls the version endpoint:
If Cymph reaches your instance through a source-IP allowlist, confirm the egress addresses are permitted — see Networking.

​
Limitations

Splunk SOAR is currently an import source only. Although the platform registers it as a workflow deployment target, the export path is not implemented, so deploying a Cymph playbook to Splunk SOAR does not work yet. If you want to read Splunk detection content instead, that is the separate Splunk Enterprise Security integration.