Complex action parameter support in a visual playbook editor
Described herein are techniques are provided for enabling a security orchestration, automation, and response (SOAR) service to automatically manage apps used to interface with an integrated security operations service and other related devices and services. Further described herein is a SOAR app generator service or application used to automate the creation of apps for a SOAR service based on application programming interfaces (API) specifications for related devices or services, as well as visual playbook editor interfaces for a SOAR service that enable the configuration of complex action input parameters including arrays and objects.
1. A computer-implemented method, comprising:
receiving, by a visual playbook editor interface of a security, orchestration, and automated response (SOAR) service, a request to add an action block to a playbook under development in the visual playbook editor interface, wherein the action block identifies an action to be performed by the SOAR service upon encountering the action block during execution of the playbook, and wherein the action is implemented in part by an app providing a client interface to an application programming interface (API) for a device or service related to the SOAR service;
identifying, based on data describing actions provided by the app, an input parameter associated with the action block, wherein the data indicates that the input parameter is one of: an array representing an ordered collection of values, or an object representing an unordered collection of name-value pairs;
causing display, in the visual playbook editor interface, of one or more graphical interface elements corresponding to the input parameter;
receiving, via the one or more graphical interface elements, one or more input values for the input parameter;
generating a representation of the one or more input values according to a data interchange format; and
providing, to the app, the representation of the one or more input values.
2. The method of claim 1 , wherein the data describing the actions provided by the app is generated by an app generator service based on an API specification for the device or service.
3. The method of claim 1 , wherein the input parameter is an array, and wherein the method further comprises:
receiving, via the visual playbook editor interface, input requesting to increase a number of graphical interface elements displayed for providing input parameter values; and
causing display of an additional graphical interface element for providing input parameter values.
4. The method of claim 1 , wherein the input parameter is an object representing an unordered collection of name-value pairs, wherein the visual playbook editor interface includes a first graphical interface element representing the object, and wherein the method further comprises:
receiving, via the visual playbook editor interface, input selecting the first graphical interface element representing the object;
causing display, in the visual playbook editor interface, of a second graphical interface element including input fields for providing values associated with name-value pairs of the unordered collection of name-value pairs represented by the object; and
receiving, via the input fields, values for the name-value pairs of the unordered collection of name-value pairs represented by the object.
5. The method of claim 1 , wherein the input parameter is an array representing an ordered collection of values, and wherein the ordered collection of values includes a plurality of objects.
6. The method of claim 1 , wherein the input parameter is an object, and wherein the object includes an array of values.
7. The method of claim 1 , wherein the input parameter is a first object representing a first unordered collection of name-value pairs, wherein the first object includes a second object, and wherein the second object includes a second unordered collection of name-value pairs.
8. The method of claim 1 , wherein the input parameter is an array, and wherein a value in the array is one of: a string, a number, a Boolean, or a null value.
9. The method of claim 1 , wherein the input parameter is a first input parameter, and wherein the method further comprises obtaining, by the SOAR service, an enumerated list of values from the device or service for a second input parameter, wherein the enumerated list of values is obtained via an endpoint defined by the app.
10. The method of claim 1 , further comprising sending, by the app, a request to the device or service to execute the action, wherein the request includes the representation of the one or more input values.
11. A computing device, comprising:
a processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
receiving, by a visual playbook editor interface of a security, orchestration, and automated response (SOAR) service, a request to add an action block to a playbook under development in the visual playbook editor interface, wherein the action block identifies an action to be performed by the SOAR service upon encountering the action block during execution of the playbook, and wherein the action is implemented in part by an app providing a client interface to an application programming interface (API) for a device or service related to the SOAR service;
identifying, based on data describing actions provided by the app, an input parameter associated with the action block, wherein the data indicates that the input parameter is one of: an array representing an ordered collection of values, or an object representing an unordered collection of name-value pairs;
causing display, in the visual playbook editor interface, of one or more graphical interface elements corresponding to the input parameter;
receiving, via the one or more graphical interface elements, one or more input values for the input parameter;
generating a representation of the one or more input values according to a data interchange format; and
providing, to the app, the representation of the one or more input values.
12. The computing device of claim 11 , wherein the data describing the actions provided by the app is generated by an app generator service based on an API specification for the device or service.
13. The computing device of claim 11 , wherein the input parameter is an array, and wherein the instructions, when executed by the processor, further cause the processor to perform operations including:
receiving, via the visual playbook editor interface, input requesting to increase a number of graphical interface elements displayed for providing input parameter values; and
causing display of an additional graphical interface element for providing input parameter values.
14. The computing device of claim 11 , wherein the input parameter is an object representing an unordered collection of name-value pairs, wherein the visual playbook editor interface includes a first graphical interface element representing the object, and wherein the instructions, when executed by the processor, further cause the processor to perform operations including:
receiving, via the visual playbook editor interface, input selecting the first graphical interface element representing the object;
causing display, in the visual playbook editor interface, of a second graphical interface element including input fields for providing values associated with name-value pairs of the unordered collection of name-value pairs represented by the object; and
receiving, via the input fields, values for the name-value pairs of the unordered collection of name-value pairs represented by the object.
15. The computing device of claim 11 , wherein the input parameter is an array representing an ordered collection of values, and wherein the ordered collection of values includes a plurality of objects.
16. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:
receiving, by a visual playbook editor interface of a security, orchestration, and automated response (SOAR) service, a request to add an action block to a playbook under development in the visual playbook editor interface, wherein the action block identifies an action to be performed by the SOAR service upon encountering the action block during execution of the playbook, and wherein the action is implemented in part by an app providing a client interface to an application programming interface (API) for a device or service related to the SOAR service;
identifying, based on data describing actions provided by the app, an input parameter associated with the action block, wherein the data indicates that the input parameter is one of: an array representing an ordered collection of values, or an object representing an unordered collection of name-value pairs;
causing display, in the visual playbook editor interface, of one or more graphical interface elements corresponding to the input parameter;
receiving, via the one or more graphical interface elements, one or more input values for the input parameter;
generating a representation of the one or more input values according to a data interchange format; and
providing, to the app, the representation of the one or more input values.
17. The non-transitory computer-readable medium of claim 16 , wherein the data describing the actions provided by the app is generated by an app generator service based on an API specification for the device or service.
18. The non-transitory computer-readable medium of claim 16 , wherein the input parameter is an array, and wherein the instructions, when executed by one or more processors, cause the one or more processors to perform operations including:
receiving, via the visual playbook editor interface, input requesting to increase a number of graphical interface elements displayed for providing input parameter values; and
causing display of an additional graphical interface element for providing input parameter values.
19. The non-transitory computer-readable medium of claim 16 , wherein the input parameter is an object representing an unordered collection of name-value pairs, wherein the visual playbook editor interface includes a first graphical interface element representing the object, and wherein the instructions, when executed by one or more processors, further cause the one or more processors to perform operations including:
receiving, via the visual playbook editor interface, input selecting the first graphical interface element representing the object;
causing display, in the visual playbook editor interface, of a second graphical interface element including input fields for providing values associated with name-value pairs of the unordered collection of name-value pairs represented by the object; and
receiving, via the input fields, values for the name-value pairs of the unordered collection of name-value pairs represented by the object.
20. The non-transitory computer-readable medium of claim 16 , wherein the input parameter is an array representing an ordered collection of values, and wherein the ordered collection of values includes a plurality of objects.