# Containers

Fetches containers from Splunk SOAR for security operations and incident tracking.

**Sync Type: Incremental Synchronisation**

## Requirements

Before configuring this input, you need:

1. **A Splunk SOAR Instance** — An active Splunk SOAR deployment with network access from Monad.

2. **Create an Auth Token** — To generate a Splunk SOAR authentication token:
    - Log in to your Splunk SOAR instance
    - Navigate to **Administration → User Management → Users**
    - Click on your user account
    - Select the **Token** tab
    - Click **Create New Token**
    - Copy the generated token and securely store it

## Details

Monad retrieves containers from Splunk SOAR incrementally using two separate queries to capture containers changed for different reasons. On the first run, all containers are fetched. On subsequent runs, only containers with updates since the last sync are retrieved.

### Data Retrieval Flow

Monad makes two separate calls to `/rest/container` on each run:

1. **Container Update Tracking** — Calls `GET /rest/container` with:
   - `sort=update_time` and `order=asc` (ascending order by update time)
   - `page=0` and `page_size=200` (200 records per page)
   - `_filter_update_time__gt` filter on subsequent runs (RFC3339Nano formatted timestamp)
   - Processes all containers in the `data` array and tracks the maximum `update_time` seen
   - Paginates using the `page` parameter and `num_pages` from the response
   - Checkpoints the maximum `update_time` as `LastContainerUpdateTime`

2. **Artifact Update Tracking** — Calls `GET /rest/container` with:
   - `sort=artifact_update_time` and `order=asc` (ascending order by artifact update time)
   - `page=0` and `page_size=200` (200 records per page)
   - `_filter_artifact_update_time__gt` filter on subsequent runs (RFC3339Nano formatted timestamp)
   - Processes all containers in the `data` array and tracks the maximum `artifact_update_time` seen
   - Paginates using the `page` parameter and `num_pages` from the response
   - Checkpoints the maximum `artifact_update_time` as `LastArtifactUpdateTime`

3. **Union and Deduplication** — Results from both calls are unioned by container ID. If a container appears in both result sets, only one record is emitted, preferring whichever has the newer timestamp.

4. **State Management** — After processing all pages from both calls, both checkpoint values (`LastContainerUpdateTime` and `LastArtifactUpdateTime`) are saved to state. On the next run, these are used as the respective filter cursors to skip containers not modified since the last sync.

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Base URL | string | Yes | Base URL of the Splunk SOAR instance (e.g., `https://soar.example.com`). Must start with `http://` or `https://`. |
| Cron | string | Yes | Standard cron expression for scheduling when this input runs. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| Auth Token | string | Yes | Splunk SOAR authentication token. Sent as the `ph-auth-token` request header. |

## Rate Limits

| Scope | Limit | Window | Notes |
|-------|-------|--------|-------|
| API Requests | 10 | Per second | Conservative limit; Splunk SOAR does not publicly document exact REST API rate limits |

**Source**: Conservative estimate based on typical enterprise API rate limiting practices.

## Related Articles

- [Splunk SOAR Query Data REST API](https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/query-for-data)
- [Splunk SOAR Containers API Reference](https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/overview/understanding-containers)

## Sample Record

```json
{
    "artifact_count": 6,
    "artifact_update_time": "2026-04-29T10:14:11.989529Z",
    "close_time": null,
    "container_type": "default",
    "create_time": "2026-04-29T10:14:11.11989529Z",
    "description": "Automated security event requiring investigation.",
    "due_time": null,
    "end_time": "2026-04-29T10:14:11.11989529Z",
    "hash": "cb9fb833-2c88-4ca7-801a-fc99271ec59a",
    "id": 3204,
    "in_case": true,
    "label": "network",
    "name": "Suspicious Login",
    "owner": 41,
    "owner_name": "admin",
    "sensitivity": "amber",
    "severity": "high",
    "source_data_identifier": "8606",
    "start_time": "2026-04-29T10:14:11.11989529Z",
    "status": "open",
    "tags": [],
    "tenant": 0,
    "update_time": "2026-04-29T10:14:11.11989529Z",
    "version": 1
}
```