{"id":41261185,"url":"https://github.com/phantomcyber/splunk-soar-sdk","last_synced_at":"2026-02-28T03:52:14.013Z","repository":{"id":290827606,"uuid":"874831078","full_name":"phantomcyber/splunk-soar-sdk","owner":"phantomcyber","description":"Splunk SOAR SDK - the official tool for Splunk SOAR app development","archived":false,"fork":false,"pushed_at":"2026-02-20T23:42:33.000Z","size":2450,"stargazers_count":7,"open_issues_count":6,"forks_count":1,"subscribers_count":7,"default_branch":"main","last_synced_at":"2026-02-21T01:10:41.736Z","etag":null,"topics":["app","cisco","connector","phantom","sdk","soar","splunk"],"latest_commit_sha":null,"homepage":"https://pypi.org/project/splunk-soar-sdk/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/phantomcyber.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-10-18T14:38:59.000Z","updated_at":"2026-02-20T19:45:49.000Z","dependencies_parsed_at":"2025-11-28T10:01:01.094Z","dependency_job_id":null,"html_url":"https://github.com/phantomcyber/splunk-soar-sdk","commit_stats":null,"previous_names":["phantomcyber/soar-apps-sdk"],"tags_count":138,"template":false,"template_full_name":null,"purl":"pkg:github/phantomcyber/splunk-soar-sdk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phantomcyber%2Fsplunk-soar-sdk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phantomcyber%2Fsplunk-soar-sdk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phantomcyber%2Fsplunk-soar-sdk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phantomcyber%2Fsplunk-soar-sdk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/phantomcyber","download_url":"https://codeload.github.com/phantomcyber/splunk-soar-sdk/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phantomcyber%2Fsplunk-soar-sdk/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29769166,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-24T01:40:24.820Z","status":"online","status_checked_at":"2026-02-24T02:00:07.497Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["app","cisco","connector","phantom","sdk","soar","splunk"],"created_at":"2026-01-23T01:59:40.873Z","updated_at":"2026-02-24T02:25:32.267Z","avatar_url":"https://github.com/phantomcyber.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Splunk SOAR SDK - the official tool for Splunk SOAR app development\n\n\u003c!-- NOTE: Coverage is not dynamically generated, but it is true because CI fails below 100% coverage --\u003e\n[![GitHub top language](https://img.shields.io/github/languages/top/phantomcyber/splunk-soar-sdk)](https://github.com/phantomcyber/splunk-soar-sdk)\n[![Python Version from PEP 621 TOML](https://img.shields.io/python/required-version-toml?tomlFilePath=https%3A%2F%2Fraw.githubusercontent.com%2Fphantomcyber%2Fsplunk-soar-sdk%2Fmain%2Fpyproject.toml)](https://github.com/phantomcyber/splunk-soar-sdk)\n[![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/phantomcyber/splunk-soar-sdk/semantic_release.yml)](https://github.com/phantomcyber/splunk-soar-sdk/deployments)\n[![Code Coverage](https://img.shields.io/badge/coverage-100%25-brightgreen)](https://github.com/phantomcyber/splunk-soar-sdk)\n[![GitHub Release](https://img.shields.io/github/v/release/phantomcyber/splunk-soar-sdk?include_prereleases)](https://github.com/phantomcyber/splunk-soar-sdk/releases)\n[![PyPI - Version](https://img.shields.io/pypi/v/splunk-soar-sdk.svg)](https://pypi.org/project/splunk-soar-sdk/)\n[![PyPI - Status](https://img.shields.io/pypi/status/splunk-soar-sdk)](https://pypi.org/project/splunk-soar-sdk/)\n[![PyPI - Types](https://img.shields.io/pypi/types/splunk-soar-sdk)](https://pypi.org/project/splunk-soar-sdk/)\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n\n## Documentation\n\nDetailed documentation can be found [here](https://phantomcyber.github.io/splunk-soar-sdk/index.html)\n\n## Installation\n\nThe Splunk SOAR SDK is available as [a package on PyPI](https://pypi.org/project/splunk-soar-sdk/).\n\nThe recommended installation method is via [uv](https://docs.astral.sh/uv/).\n\n## Find us at .conf25\n\nTo learn more about the SDK, check out our (presentation slides)[https://conf.splunk.com/files/2025/slides/DEV1495.pdf] from .conf25!\n\n## Installing the SDK as a tool\n\nThis package defines the `soarapps` command line interface. To use it, [install as a uv tool](https://docs.astral.sh/uv/guides/tools/):\n\n```shell\nuv tool install splunk-soar-sdk\nsoarapps --help\n```\n\n## Quick Start\n\n**Create a new, empty app**: Run `soarapps init`.\n\n**Migrate an existing app to the SDK**: Run `soarapps convert myapp`, where `myapp` is your app written using BaseConnector. This will convert asset configuration, action declarations, and inputs and outputs. You'll still need to re-implement your action code, as well as any custom views and webhooks.\n\n## Getting Help\n\nIf you need help, please file a GitHub issue at https://github.com/phantomcyber/splunk-soar-sdk/issues.\n\n## Installing the SDK as an app dependency\n\nWhen developing a new Splunk SOAR app using the SDK, you should use [uv](https://docs.astral.sh/uv/) as your project management tool:\n\n```shell\nuv add splunk-soar-sdk\n```\n\nRunning the above command will add `splunk-soar-sdk` as a dependency of your Splunk SOAR app, in your `pyproject.toml` file.\n\n## Usage\n\nIn order to start using SDK and build your first Splunk SOAR App, follow the [Getting Started guide](https://phantomcyber.github.io/splunk-soar-sdk/getting_started/index.html).\n\nA Splunk SOAR app developed with the SDK will look something like this:\n\nProject structure:\n\n```text\nstring_reverser/\n├─ src/\n│  ├─ __init__.py\n│  ├─ app.py\n├─ tests/\n│  ├─ __init__.py\n│  ├─ test_app.py\n├─ .pre-commit-config.yaml\n├─ logo.svg\n├─ logo_dark.svg\n├─ pyproject.toml\n```\n\nWith `app.py` containing:\n\n```python\nfrom soar_sdk.abstract import SOARClient\nfrom soar_sdk.app import App\nfrom soar_sdk.asset import AssetField, BaseAsset\nfrom soar_sdk.params import Params\nfrom soar_sdk.action_results import ActionOutput\n\n\nclass Asset(BaseAsset):\n    base_url: str\n    api_key: str = AssetField(sensitive=True, description=\"API key for authentication\")\n\n\napp = App(name=\"test_app\", asset_cls=Asset, appid=\"1e1618e7-2f70-4fc0-916a-f96facc2d2e4\", app_type=\"sandbox\", logo=\"logo.svg\", logo_dark=\"logo_dark.svg\", product_vendor=\"Splunk\", product_name=\"Example App\", publisher=\"Splunk\")\n\n\n@app.test_connectivity()\ndef test_connectivity(soar: SOARClient, asset: Asset) -\u003e None:\n    soar.debug(f\"testing connectivity against {asset.base_url}\")\n\n\nclass ReverseStringParams(Params):\n    input_string: str\n\n\nclass ReverseStringOutput(ActionOutput):\n    reversed_string: str\n\n\n@app.action(action_type=\"test\", verbose=\"Reverses a string.\")\ndef reverse_string(\n    param: ReverseStringParams, soar: SOARClient\n) -\u003e ReverseStringOutput:\n    reversed_string = param.input_string[::-1]\n    return ReverseStringOutput(reversed_string=reversed_string)\n\n\nif __name__ == \"__main__\":\n    app.cli()\n```\n\n## Requirements\n\n* [uv](https://docs.astral.sh/uv/getting-started/installation/)\n* Python \u003e=3.9\n  * Python may be installed locally [with uv](https://docs.astral.sh/uv/guides/install-python/)\n* Splunk SOAR \u003e=6.4.0\n  * You can get Splunk SOAR Community Edition from [the Splunk website](https://www.splunk.com/en_us/products/splunk-security-orchestration-and-automation.html)\n\n---\n\nCopyright 2025 Splunk Inc.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n\u003chttp://www.apache.org/licenses/LICENSE-2.0\u003e\n\nUnless required by applicable law or agreed to in writing,\nsoftware distributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and limitations under the License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphantomcyber%2Fsplunk-soar-sdk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fphantomcyber%2Fsplunk-soar-sdk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphantomcyber%2Fsplunk-soar-sdk/lists"}