The extension for developers building applications for Splunk SOAR. Works with SOAR hosted either on-prem or in Cloud and its goal is to make the app development experience as seamless and efficient as possible on the VS Code editor platform.
During setup, the extension is configured to connect to the SOAR platform. This allows the extension to pull information from SOAR and allows the developer to perform common operations such as browsing of remote objects, running actions and managing resulting action runs.
The screenshots below are taken from the Visual Studio Code environment where the extension is installed successfully.
Browse the full documentation.
- Browse apps and assets configured on the connected SOAR instance via Tree View
- Apps Installation via custom SOAR App Build Task to install a local SOAR app on the configured instance with a single key combination
- Integrated Actions Execution to run a given action on the configured instance
- Integrated Playbooks Execution to run a given playbook on the configured instance
- Built-in App Wizard to bootstrap a new local SOAR App project
- Smart Run Action CodeLens to detect action handlers in connector code and provide an inline action command
- Set of useful SOAR commands aiming to
- Browse remote SOAR objects such as Containers, Assets, Apps
- Navigate to SOAR Web UI
- Integrated SOAR: Container Watcher Console to watch containers for changes at either action or playbook execution
Download the extension via the Visual Studio Marketplace.
Alternatively, download the VSIX file from the Releases page and use the Extensions -> Install from VSIX... dialog within the VS Code extension panel.
After successful installation, open the Splunk SOAR view from the sidebar and press the Connect Environment button to set up the connection to your SOAR environment. Type info such as SOAR URL and credentials to the appearing step-by-step interactive dialog. Once the environment is set up, it will be activated automatically.
Use the available context menu to manage environment(s) and receive information about them. To open the context menu, right-click on the desired environment listed in the view.
You can create multiple environments to quickly context-switch between remote SOAR instances, but only a single environment can be active at the same time. To connect another environment click the plus icon on the top right of the view
To install your locally developed app to the configured SOAR instance, click on the upload icon on the top right of the apps view. You'll be prompted to select the folder containing your app bundle (.tgz file)
If you don't have a bundled app yet, automatically bundle and install it by following these instructions
NOTE: Your app code must be opened in a dedicated VSCode window to work
- Select the action you want to run from the Apps View
- Click on the play icon for that action
- Provide action parameters as well as execution context info (e.g. asset, container) at request in the appearing interactive dialog
Once the operation has completed, results will be displayed in the OUTPUT terminal.
To re-execute the action keeping the same parameters and context, simply click on the refresh icon for that specific action in Action Runs View.
By hovering over each run listed under the Action Runs View, additional contextual information can be displayed. Quick links for inspecting the elements can be clicked to open details for both the action run and the container.
By right-clicking on each run users can:
- Inspect the Action Run,
- View the action in SOAR Web UI
- Select the playbook you want to run from the Playbooks View
- Click on the play icon for that playbook
- Provide scope as well as execution context info (e.g. asset, container) at request in the appearing interactive dialog
Once the operation has completed, results will be displayed in the OUTPUT terminal.
To re-execute the playbook keeping the same parameters and context, simply click on the refresh icon for that specific action in Playbook Runs View.
By right-clicking on each playbook users can:
- Inspect the playbook,
- View the playbook code,
- Download the playbook bundle (
tgz), - Open the playbook in Visual Playbook Editor
Similarly to Actions, by hovering over each run listed under the Playbook Runs View, additional contextual information can be displayed. Quick links for inspecting the elements can be clicked to open details for both the playbook run and the container.
Execution logs can be displayed by:
- right-clicking on a run listed under the Playbook Runs View
- clicking on "Logs"
- VS Code 1.101 or newer
- Node.js 22.18.0 (the repository includes an
.nvmrc) - Yarn 1.22.22
This repository uses Yarn exclusively. Do not use npm to install or update dependencies; the root extension and the documentation site each have their own yarn.lock.
git clone https://github.com/splunk/vscode-extension-splunk-soar.git
cd vscode-extension-splunk-soar
nvm use
yarn install --frozen-lockfile
code .If the requested Node.js version is not installed yet, run nvm install before nvm use.
- Open Run and Debug in VS Code and start the Run Extension configuration, or press
F5. - The default
yarn: watchtask starts webpack in watch mode and opens an Extension Development Host window with a temporary VS Code profile. - Exercise the change in the Extension Development Host. Open the Splunk SOAR view or invoke a contributed command to activate the extension.
- After changing extension or webview source code, wait for webpack to finish rebuilding, then run Developer: Reload Window in the Extension Development Host to load the new bundles.
- Set breakpoints in
src/and inspect extension-host output in the Debug Console. Webview code is bundled fromapp/src/intoapp/build/.
The temporary profile does not inherit environments configured in your regular VS Code profile. If a change requires a SOAR connection, configure a non-production SOAR environment inside the Extension Development Host.
Run these before opening a pull request:
# Type-check the extension without emitting JavaScript
yarn check-types
# Lint extension and webview sources
yarn lint
# Create development bundles once, without watch mode
yarn compile
# Create optimized production bundles
yarn package
# Build the same VSIX artifact produced by CI
yarn vsce package --out vscode-splunk-soar.vsixThe current lint configuration reports an existing warning backlog but should complete with zero errors. Webpack also reports bundle-size recommendations for the webviews; these warnings do not fail the build.
There is currently no automated extension-host test suite. The required verification is type-checking, linting, production bundling, and exercising the affected workflow in the Extension Development Host.
Run dependency commands from the directory whose manifest is being updated:
# Runtime dependency
yarn add <package>
# Development dependency
yarn add --dev <package>
# Remove a dependency
yarn remove <package>Commit both the affected package.json and its yarn.lock. Verify the resulting graph with yarn install --frozen-lockfile and yarn audit.
The Docusaurus site is an independent Yarn project under docs/:
cd docs
yarn install --frozen-lockfile
yarn startThe development server is available at http://localhost:3000. Run yarn build from docs/ to verify a production documentation build.
The documentation is located on https://splunk.github.io/vscode-extension-splunk-soar/ and hosted via Github Pages.
Please review our Contribution Guide
Please refer to License with regards to licensing. This software is released as-is. Splunk provides no warranty and no support on this software. If you have any issues with the software, please file an issue on the repository.
Copyright 2022 Splunk Inc.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.