> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk SOAR

> Import playbooks from a Splunk SOAR instance into Cymph.

## What Cymph uses it for

Cymph connects to Splunk SOAR to browse and import the playbooks already on your instance, so existing automation can be brought into Cymph. See [Import a playbook](/howto/import_playbook).

All operations are currently **read-only** — Cymph never creates, modifies, or runs a playbook on the instance.

<Note>
  Deploying playbooks **to** Splunk SOAR is not yet available. See [Limitations](#limitations).
</Note>

## Requirements

| Field | Description |
| - | - |
| **Instance URL** | The base URL of your Splunk SOAR instance, e.g. `https://soar.example.com` |
| **Token** | A Splunk SOAR automation token |

## Token setup

Cymph authenticates with a **`ph-auth-token`** header, which takes a Splunk SOAR **automation user** token rather than a password.

1. Create (or choose) an automation user: **Administration → User Management → Users**, with user type **Automation**.
2. Copy the token generated for that user.
3. Give the automation user a role with read access to playbooks.

<Tip>
  Automation users exist for exactly this purpose — they are non-interactive and their activity is easy to separate from human analysts in the audit log. Do not use a personal account's token.
</Tip>

## Permissions

The token inherits the role of the automation user it belongs to. Splunk SOAR exposes three permission types on the **Playbooks** resource — **view**, **edit**, and **execute** — and Cymph needs only the first:

| Permission | Setting | Why |
| - | - | - |
| Playbooks — **view** | Enabled | List playbooks and read their definitions |
| Playbooks — **edit** | Not required | Cymph never modifies a playbook on the instance |
| Playbooks — **execute** | Not required | Cymph never runs a playbook or an action |

<Warning>
  The default **Automation** role has a broad set of permissions — it is designed to cover whatever a service account might need. For least privilege, create a custom role with only Playbooks → view and assign that to the automation user instead.
</Warning>

<Note>
  Splunk SOAR roles can also be restricted to whitelisted **repositories**. If you use that, make sure the role can reach the repositories holding the playbooks you want to import — Cymph reads the source-control repository list to disambiguate playbooks that share a name.
</Note>

## What Cymph reads

| Purpose | Splunk SOAR REST call |
| - | - |
| Test the connection | `GET /rest/version` |
| List available playbooks | `GET /rest/playbook?page_size=0` |
| Read a playbook by ID | `GET /rest/playbook/{playbook_id}` |
| Look up a playbook by name within a repository | `GET /rest/playbook?_filter_name={name}&include_expensive` |
| List source-control repositories | `GET /rest/scm/` |

Playbooks can be addressed either by their numeric ID or as `{repository_id}/{playbook_name}` — Cymph resolves the repository from the source-control list so playbooks with the same name in different repositories stay distinct.

## Testing the connection

**Test Connection** calls the version endpoint:

| Message | Meaning |
| - | - |
| **Authorization failed** | The instance was reached but rejected the token |
| **Connection timed out** | No response within the timeout — check network reachability and any firewall or allowlist between Cymph and the instance |

<Note>
  If Cymph reaches your instance through a source-IP allowlist, confirm the egress addresses are permitted — see [Networking](/deployment/networking#egress-control).
</Note>

## Limitations

Splunk SOAR is currently an **import source only**. Although the platform registers it as a workflow deployment target, the export path is not implemented, so deploying a Cymph playbook to Splunk SOAR does not work yet.

If you want to read Splunk detection content instead, that is the separate [Splunk Enterprise Security](/integrations/detection/splunk-es) integration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.