> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk SOAR

> Import playbooks from a Splunk SOAR instance into Cymph.

## What Cymph uses it for

Cymph connects to Splunk SOAR to browse and import the playbooks already on your instance, so existing automation can be brought into Cymph. See [Import a playbook](/howto/import_playbook).

All operations are currently **read-only** — Cymph never creates, modifies, or runs a playbook on the instance.

<Note>
  Deploying playbooks **to** Splunk SOAR is not yet available. See [Limitations](#limitations).
</Note>

## Requirements

| Field            | Description                                                                |
| ---------------- | -------------------------------------------------------------------------- |
| **Instance URL** | The base URL of your Splunk SOAR instance, e.g. `https://soar.example.com` |
| **Token**        | A Splunk SOAR automation token                                             |

## Token setup

Cymph authenticates with a **`ph-auth-token`** header, which takes a Splunk SOAR **automation user** token rather than a password.

1. Create (or choose) an automation user: **Administration → User Management → Users**, with user type **Automation**.
2. Copy the token generated for that user.
3. Give the automation user a role with read access to playbooks.

<Tip>
  Automation users exist for exactly this purpose — they are non-interactive and their activity is easy to separate from human analysts in the audit log. Do not use a personal account's token.
</Tip>

## Permissions

The token inherits the role of the automation user it belongs to. Splunk SOAR exposes three permission types on the **Playbooks** resource — **view**, **edit**, and **execute** — and Cymph needs only the first:

| Permission              | Setting      | Why                                             |
| ----------------------- | ------------ | ----------------------------------------------- |
| Playbooks — **view**    | Enabled      | List playbooks and read their definitions       |
| Playbooks — **edit**    | Not required | Cymph never modifies a playbook on the instance |
| Playbooks — **execute** | Not required | Cymph never runs a playbook or an action        |

<Warning>
  The default **Automation** role has a broad set of permissions — it is designed to cover whatever a service account might need. For least privilege, create a custom role with only Playbooks → view and assign that to the automation user instead.
</Warning>

<Note>
  Splunk SOAR roles can also be restricted to whitelisted **repositories**. If you use that, make sure the role can reach the repositories holding the playbooks you want to import — Cymph reads the source-control repository list to disambiguate playbooks that share a name.
</Note>

## What Cymph reads

| Purpose                                        | Splunk SOAR REST call                                      |
| ---------------------------------------------- | ---------------------------------------------------------- |
| Test the connection                            | `GET /rest/version`                                        |
| List available playbooks                       | `GET /rest/playbook?page_size=0`                           |
| Read a playbook by ID                          | `GET /rest/playbook/{playbook_id}`                         |
| Look up a playbook by name within a repository | `GET /rest/playbook?_filter_name={name}&include_expensive` |
| List source-control repositories               | `GET /rest/scm/`                                           |

Playbooks can be addressed either by their numeric ID or as `{repository_id}/{playbook_name}` — Cymph resolves the repository from the source-control list so playbooks with the same name in different repositories stay distinct.

## Testing the connection

**Test Connection** calls the version endpoint:

| Message                  | Meaning                                                                                                                  |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------ |
| **Authorization failed** | The instance was reached but rejected the token                                                                          |
| **Connection timed out** | No response within the timeout — check network reachability and any firewall or allowlist between Cymph and the instance |

<Note>
  If Cymph reaches your instance through a source-IP allowlist, confirm the egress addresses are permitted — see [Networking](/deployment/networking#egress-control).
</Note>

## Limitations

Splunk SOAR is currently an **import source only**. Although the platform registers it as a workflow deployment target, the export path is not implemented, so deploying a Cymph playbook to Splunk SOAR does not work yet.

If you want to read Splunk detection content instead, that is the separate [Splunk Enterprise Security](/integrations/detection/splunk-es) integration.