splunk-soar-sdk 2.1.1__tar.gz → 2.3.0__tar.gz

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splunk-soar-sdk
-Version: 2.1.1
+Version: 2.3.0
 Summary: The official framework for developing and testing Splunk SOAR Apps
 Project-URL: Homepage, https://github.com/phantomcyber/splunk-soar-sdk
 Project-URL: Documentation, https://github.com/phantomcyber/splunk-soar-sdk

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "splunk-soar-sdk"
-version = "2.1.1"
+version = "2.3.0"
 description = "The official framework for developing and testing Splunk SOAR Apps"
 readme = "README.md"
 requires-python = ">=3.9, <3.14"

splunk_soar_sdk-2.3.0/release_notes.txt

@@ -0,0 +1,31 @@
+# [2.3.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/2.2.0...2.3.0) (2025-10-02)
+
+
+### Bug Fixes
+
+* get rid of column_order and maintain counter instead ([c9b011d](https://github.com/phantomcyber/splunk-soar-sdk/commit/c9b011d84688f22b5ac2aa7f32a29468762ebe0d))
+
+
+### Features
+
+* adding column name and column order to params as well ([69a752e](https://github.com/phantomcyber/splunk-soar-sdk/commit/69a752e19d9c730ef319277480aa0a24fca03c2e))
+
+
+
+
+
+# [2.3.0](https://github.com/phantomcyber/splunk-soar-sdk/compare/2.2.0...2.3.0) (2025-10-02)
+
+
+### Bug Fixes
+
+* get rid of column_order and maintain counter instead ([c9b011d](https://github.com/phantomcyber/splunk-soar-sdk/commit/c9b011d84688f22b5ac2aa7f32a29468762ebe0d))
+
+
+### Features
+
+* adding column name and column order to params as well ([69a752e](https://github.com/phantomcyber/splunk-soar-sdk/commit/69a752e19d9c730ef319277480aa0a24fca03c2e))
+
+
+
+

splunk_soar_sdk-2.3.0/release_version.txt

@@ -0,0 +1 @@
+2.3.0

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/src/soar_sdk/action_results.py

@@ -2,10 +2,10 @@ from typing import Optional, Union, get_origin, get_args, Any
 from collections.abc import Iterator
 from typing_extensions import NotRequired, TypedDict
 from pydantic import BaseModel, Field
+import itertools
 
 from soar_sdk.compat import remove_when_soar_newer_than
 from soar_sdk.shims.phantom.action_result import ActionResult as PhantomActionResult
-
 from soar_sdk.meta.datatypes import as_datatype
 
 remove_when_soar_newer_than(
@@ -83,12 +83,15 @@ class OutputFieldSpecification(TypedDict):
     data_type: str
     contains: NotRequired[list[str]]
     example_values: NotRequired[list[Union[str, float, bool]]]
+    column_name: NotRequired[str]
+    column_order: NotRequired[int]
 
 
 def OutputField(
     cef_types: Optional[list[str]] = None,
     example_values: Optional[list[Union[str, float, bool]]] = None,
     alias: Optional[str] = None,
+    column_name: Optional[str] = None,
 ) -> Any:  # noqa: ANN401
     """Define metadata for an action output field.
 
@@ -102,6 +105,10 @@ def OutputField(
         example_values: Optional list of example values for this field, used
             in documentation and for testing/validation purposes.
         alias: Optional alternative name for the field when serialized.
+        column_name: Optional name for the field when displayed in a table.
+
+    Note:
+        Column name and order must be set together, if one is set but the other is not, an error will be raised.
 
     Returns:
         A Pydantic Field object with the specified metadata.
@@ -116,8 +123,9 @@ def OutputField(
     """
     return Field(
         examples=example_values,
-        cef_types=cef_types,
         alias=alias,
+        cef_types=cef_types,
+        column_name=column_name,
     )
 
 
@@ -152,7 +160,9 @@ class ActionOutput(BaseModel):
 
     @classmethod
     def _to_json_schema(
-        cls, parent_datapath: str = "action_result.data.*"
+        cls,
+        parent_datapath: str = "action_result.data.*",
+        column_order_counter: Optional[itertools.count] = None,
     ) -> Iterator[OutputFieldSpecification]:
         """Convert the ActionOutput class to SOAR-compatible JSON schema.
 
@@ -163,6 +173,8 @@ class ActionOutput(BaseModel):
         Args:
             parent_datapath: The base datapath for fields in this output.
                 Defaults to "action_result.data.*" for top-level outputs.
+            column_order_counter: Iterator for tracking column order across fields.
+                Used internally to maintain sequential column ordering. Defaults to itertools.count().
 
         Yields:
             OutputFieldSpecification objects describing each field in the schema.
@@ -176,6 +188,9 @@ class ActionOutput(BaseModel):
             Nested ActionOutput classes are recursively processed.
             Boolean fields automatically get [True, False] example values.
         """
+        if column_order_counter is None:
+            column_order_counter = itertools.count()
+
         for _field_name, field in cls.__fields__.items():
             field_name = alias if (alias := field.alias) else _field_name
 
@@ -208,7 +223,7 @@ class ActionOutput(BaseModel):
 
             if issubclass(field_type, ActionOutput):
                 # If the field is another ActionOutput, recursively call _to_json_schema
-                yield from field_type._to_json_schema(datapath)
+                yield from field_type._to_json_schema(datapath, column_order_counter)
                 continue
             else:
                 try:
@@ -230,6 +245,12 @@ class ActionOutput(BaseModel):
             if field_type is bool:
                 schema_field["example_values"] = [True, False]
 
+            column_name = field.field_info.extra.get("column_name")
+
+            if column_name is not None:
+                schema_field["column_name"] = column_name
+                schema_field["column_order"] = next(column_order_counter)
+
             yield schema_field
 
 

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/src/soar_sdk/app.py

@@ -237,6 +237,7 @@ class App:
         read_only: bool = True,
         params_class: Optional[type[Params]] = None,
         output_class: Optional[type[ActionOutput]] = None,
+        render_as: Optional[str] = None,
         view_handler: Union[str, Callable, None] = None,
         view_template: Optional[str] = None,
         versions: str = "EQ(*)",
@@ -355,6 +356,7 @@ class App:
             read_only=read_only,
             params_class=params_class,
             output_class=output_class,
+            render_as=render_as,
             view_handler=view_handler,
             versions=versions,
             summary_type=summary_type,
@@ -421,6 +423,7 @@ class App:
         read_only: bool = True,
         params_class: Optional[type[Params]] = None,
         output_class: Optional[type[ActionOutput]] = None,
+        render_as: Optional[str] = None,
         view_handler: Optional[Callable] = None,
         versions: str = "EQ(*)",
         summary_type: Optional[type[ActionOutput]] = None,
@@ -440,6 +443,7 @@ class App:
             read_only=read_only,
             params_class=params_class,
             output_class=output_class,
+            render_as=render_as,
             view_handler=view_handler,
             versions=versions,
             summary_type=summary_type,

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/src/soar_sdk/cli/manifests/serializers.py

@@ -1,6 +1,7 @@
 from typing import Any, Optional
 from collections.abc import Iterator
 from logging import getLogger
+import itertools
 
 from soar_sdk.meta.datatypes import as_datatype
 from soar_sdk.params import Params
@@ -29,8 +30,12 @@ class OutputsSerializer:
     @staticmethod
     def serialize_parameter_datapaths(
         params_class: type[Params],
+        column_order_counter: Optional[itertools.count] = None,
     ) -> Iterator[OutputFieldSpecification]:
         """Serializes the parameter data paths of a Params class to JSON schema."""
+        if column_order_counter is None:
+            column_order_counter = itertools.count()
+
         for field_name, field in params_class.__fields__.items():
             spec = OutputFieldSpecification(
                 data_path=f"action_result.parameter.{field_name}",
@@ -38,6 +43,12 @@ class OutputsSerializer:
             )
             if cef_types := field.field_info.extra.get("cef_types"):
                 spec["contains"] = cef_types
+
+            column_name = field.field_info.extra.get("column_name")
+
+            if column_name is not None:
+                spec["column_name"] = column_name
+                spec["column_order"] = next(column_order_counter)
             yield spec
 
     @classmethod
@@ -57,10 +68,13 @@ class OutputsSerializer:
             data_path="action_result.message",
             data_type="string",
         )
-        params = cls.serialize_parameter_datapaths(params_class)
-        outputs = outputs_class._to_json_schema()
+        column_order_counter = itertools.count()
+        params = cls.serialize_parameter_datapaths(params_class, column_order_counter)
+        outputs = outputs_class._to_json_schema(
+            column_order_counter=column_order_counter
+        )
         summary = (
-            summary_class._to_json_schema("action_result.summary")
+            summary_class._to_json_schema("action_result.summary", column_order_counter)
             if summary_class
             else []
         )

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/src/soar_sdk/decorators/action.py

@@ -39,6 +39,7 @@ class ActionDecorator:
             AsyncGenerator[type[ActionOutput]],
             list[type[ActionOutput]],
         ] = None,
+        render_as: Optional[str] = None,
         view_handler: Optional[Callable] = None,
         versions: str = "EQ(*)",
         summary_type: Optional[type[ActionOutput]] = None,
@@ -53,6 +54,7 @@ class ActionDecorator:
         self.read_only = read_only
         self.params_class = params_class
         self.output_class = output_class
+        self.render_as = render_as
         self.view_handler = view_handler
         self.versions = versions
         self.summary_type = summary_type
@@ -100,6 +102,14 @@ class ActionDecorator:
                 "Return type for action function must be derived from ActionOutput class."
             )
 
+        if self.view_handler:
+            self.render_as = "custom"
+
+        if self.render_as and self.render_as not in ("table", "json", "custom"):
+            raise ValueError(
+                "Please only specify render_as as 'table' or 'json' or 'custom'."
+            )
+
         @action_protocol
         @wraps(function)
         def inner(
@@ -152,6 +162,7 @@ class ActionDecorator:
             parameters=validated_params_class,
             output=validated_output_class,
             versions=self.versions,
+            render_as=self.render_as,
             view_handler=self.view_handler,
             summary_type=self.summary_type,
             enable_concurrency_lock=self.enable_concurrency_lock,

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/src/soar_sdk/meta/actions.py

@@ -20,6 +20,7 @@ class ActionMeta(BaseModel):
     verbose: str = ""
     parameters: Type[Params] = Field(default=Params)  # noqa: UP006
     output: Type[ActionOutput] = Field(default=ActionOutput)  # noqa: UP006
+    render_as: Optional[str] = None
     view_handler: Optional[Callable] = None
     summary_type: Optional[Type[ActionOutput]] = Field(default=None, exclude=True)  # noqa: UP006
     enable_concurrency_lock: bool = False
@@ -31,6 +32,13 @@ class ActionMeta(BaseModel):
         data["output"] = OutputsSerializer.serialize_datapaths(
             self.parameters, self.output, summary_class=self.summary_type
         )
+        if self.view_handler:
+            self.render_as = "custom"
+
+        if self.render_as:
+            data["render"] = {
+                "type": self.render_as,
+            }
 
         if self.view_handler:
             remove_when_soar_newer_than("6.4.1")
@@ -45,13 +53,11 @@ class ActionMeta(BaseModel):
             else:
                 relative_module = module
 
-            data["render"] = {
-                "type": "custom",
-                "view": f"{relative_module}.{self.view_handler.__name__}",
-            }
+            data["render"]["view"] = f"{relative_module}.{self.view_handler.__name__}"
 
         # Remove view_handler from the output since in render
         data.pop("view_handler", None)
+        data.pop("render_as", None)
 
         if self.enable_concurrency_lock:
             data["lock"] = {"enabled": True}

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/src/soar_sdk/params.py

@@ -22,6 +22,7 @@ def Param(
     allow_list: bool = False,
     sensitive: bool = False,
     alias: Optional[str] = None,
+    column_name: Optional[str] = None,
 ) -> Any:  # noqa: ANN401
     """Representation of a single complex action parameter.
 
@@ -49,6 +50,7 @@ def Param(
     :param allow_list: Use this key to specify if the parameter supports specifying
       multiple values as a comma separated string.
     :param kwargs: additional kwargs accepted by pydantic.Field
+    :param column_name: Optional name for the parameter when displayed in an output table.
     :return: returns the FieldInfo object as pydantic.Field
     """
     if value_list is None:
@@ -64,6 +66,7 @@ def Param(
         allow_list=allow_list,
         sensitive=sensitive,
         alias=alias,
+        column_name=column_name,
     )
 
 
@@ -80,6 +83,8 @@ class InputFieldSpecification(TypedDict):
     value_list: NotRequired[list[str]]
     allow_list: bool
     default: NotRequired[Union[str, int, float, bool]]
+    column_name: NotRequired[str]
+    column_order: NotRequired[int]
 
 
 class Params(BaseModel):

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/tests/cli/test_deserializers.py

@@ -438,7 +438,11 @@ def test_from_action_json_with_parameters_and_output(mock_action_deserializer):
             },
         },
         "output": [
-            {"data_path": "action_result.data.*.result"},
+            {
+                "data_path": "action_result.data.*.result",
+                "column_name": "Result",
+                "column_order": 0,
+            },
             {"data_path": "action_result.summary.total_items"},
         ],
     }

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/tests/cli/test_serializers.py

@@ -153,13 +153,17 @@ def test_outputs_serialize_with_defaults():
 
 def test_outputs_serialize_output_class():
     class SampleNestedOutput(ActionOutput):
-        bool_value: bool
+        bool_value: bool = OutputField(column_name="Nested Value")
 
     class SampleOutput(ActionOutput):
         string_value: str
         int_value: int
         list_value: list[str]
-        cef_value: str = OutputField(cef_types=["ip"], example_values=["1.1.1.1"])
+        cef_value: str = OutputField(
+            cef_types=["ip"],
+            example_values=["1.1.1.1"],
+            column_name="CEF Value",
+        )
         nested_value: SampleNestedOutput
         underscored_value: str = OutputField(alias="_underscored_value")
 
@@ -192,11 +196,15 @@ def test_outputs_serialize_output_class():
             "data_type": "string",
             "contains": ["ip"],
             "example_values": ["1.1.1.1"],
+            "column_name": "CEF Value",
+            "column_order": 0,
         },
         {
             "data_path": "action_result.data.*.nested_value.bool_value",
             "data_type": "boolean",
             "example_values": [True, False],
+            "column_name": "Nested Value",
+            "column_order": 1,
         },
         {
             "data_path": "action_result.data.*._underscored_value",
@@ -297,3 +305,84 @@ def test_outputs_serialize_with_parameters_class():
             "example_values": [1],
         },
     ]
+
+
+def test_serialize_parameter_datapaths():
+    class SampleParams(Params):
+        cef_value: str = Param(cef_types=["user name"], column_name="CEF Value")
+
+    serialized_parameter_datapaths = list(
+        OutputsSerializer.serialize_parameter_datapaths(SampleParams)
+    )
+
+    assert serialized_parameter_datapaths == [
+        {
+            "data_path": "action_result.parameter.cef_value",
+            "data_type": "string",
+            "contains": ["user name"],
+            "column_name": "CEF Value",
+            "column_order": 0,
+        },
+    ]
+
+
+def test_serilized_datapaths_params():
+    class SampleParams(Params):
+        int_value: int
+        str_value: str
+        bool_value: bool
+        cef_value: str = Param(cef_types=["user name"], column_name="CEF Value")
+
+    class SampleOutput(ActionOutput):
+        string_value: str = OutputField(column_name="String Value")
+
+    serialized_outputs = OutputsSerializer.serialize_datapaths(
+        SampleParams, SampleOutput
+    )
+
+    assert serialized_outputs == [
+        {
+            "data_path": "action_result.status",
+            "data_type": "string",
+            "example_values": ["success", "failure"],
+        },
+        {
+            "data_path": "action_result.message",
+            "data_type": "string",
+        },
+        {
+            "data_path": "action_result.parameter.int_value",
+            "data_type": "numeric",
+        },
+        {
+            "data_path": "action_result.parameter.str_value",
+            "data_type": "string",
+        },
+        {
+            "data_path": "action_result.parameter.bool_value",
+            "data_type": "boolean",
+        },
+        {
+            "data_path": "action_result.parameter.cef_value",
+            "data_type": "string",
+            "contains": ["user name"],
+            "column_name": "CEF Value",
+            "column_order": 0,
+        },
+        {
+            "data_path": "action_result.data.*.string_value",
+            "data_type": "string",
+            "column_name": "String Value",
+            "column_order": 1,
+        },
+        {
+            "data_path": "summary.total_objects",
+            "data_type": "numeric",
+            "example_values": [1],
+        },
+        {
+            "data_path": "summary.total_objects_successful",
+            "data_type": "numeric",
+            "example_values": [1],
+        },
+    ]

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/tests/example_app/app.json

@@ -175,6 +175,149 @@
             "verbose": "",
             "versions": "EQ(*)"
         },
+        {
+            "action": "test json output",
+            "identifier": "test_json_output",
+            "description": "test json output",
+            "type": "generic",
+            "read_only": true,
+            "versions": "EQ(*)",
+            "verbose": "",
+            "parameters": {},
+            "output": [
+                {
+                    "data_path": "action_result.status",
+                    "data_type": "string",
+                    "example_values": [
+                        "success",
+                        "failure"
+                    ]
+                },
+                {
+                    "data_path": "action_result.message",
+                    "data_type": "string"
+                },
+                {
+                    "data_path": "action_result.data.*.name",
+                    "data_type": "string",
+                    "example_values": [
+                        "John",
+                        "Jane",
+                        "Jim"
+                    ],
+                    "column_name": "Name",
+                    "column_order": 0
+                },
+                {
+                    "data_path": "action_result.data.*.age",
+                    "data_type": "numeric",
+                    "example_values": [
+                        25,
+                        30,
+                        35
+                    ],
+                    "column_name": "Age",
+                    "column_order": 1
+                },
+                {
+                    "data_path": "summary.total_objects",
+                    "data_type": "numeric",
+                    "example_values": [
+                        1
+                    ]
+                },
+                {
+                    "data_path": "summary.total_objects_successful",
+                    "data_type": "numeric",
+                    "example_values": [
+                        1
+                    ]
+                }
+            ],
+            "render": {
+                "type": "json"
+            }
+        },
+        {
+            "action": "test table output",
+            "identifier": "test_table_output",
+            "description": "test table output",
+            "type": "generic",
+            "read_only": true,
+            "versions": "EQ(*)",
+            "verbose": "",
+            "parameters": {
+                "company_name": {
+                    "order": 0,
+                    "name": "company_name",
+                    "description": "Company Name",
+                    "data_type": "string",
+                    "required": true,
+                    "primary": false,
+                    "allow_list": false,
+                    "default": "Splunk"
+                }
+            },
+            "output": [
+                {
+                    "data_path": "action_result.status",
+                    "data_type": "string",
+                    "example_values": [
+                        "success",
+                        "failure"
+                    ]
+                },
+                {
+                    "data_path": "action_result.message",
+                    "data_type": "string"
+                },
+                {
+                    "data_path": "action_result.parameter.company_name",
+                    "data_type": "string",
+                    "column_name": "Company Name",
+                    "column_order": 0
+                },
+                {
+                    "data_path": "action_result.data.*.name",
+                    "data_type": "string",
+                    "example_values": [
+                        "John",
+                        "Jane",
+                        "Jim"
+                    ],
+                    "column_name": "Name",
+                    "column_order": 1
+                },
+                {
+                    "data_path": "action_result.data.*.age",
+                    "data_type": "numeric",
+                    "example_values": [
+                        25,
+                        30,
+                        35
+                    ],
+                    "column_name": "Age",
+                    "column_order": 2
+                },
+                {
+                    "data_path": "summary.total_objects",
+                    "data_type": "numeric",
+                    "example_values": [
+                        1
+                    ]
+                },
+                {
+                    "data_path": "summary.total_objects_successful",
+                    "data_type": "numeric",
+                    "example_values": [
+                        1
+                    ]
+                }
+            ],
+            "render": {
+                "type": "table"
+            }
+        },
         {
             "action": "reverse string",
             "identifier": "reverse_string",

{splunk_soar_sdk-2.1.1 → splunk_soar_sdk-2.3.0}/tests/example_app/src/app.py

@@ -5,10 +5,10 @@ from zoneinfo import ZoneInfo
 from soar_sdk.abstract import SOARClient
 from soar_sdk.app import App
 from soar_sdk.asset import AssetField, BaseAsset
-from soar_sdk.params import OnPollParams, MakeRequestParams, Params
+from soar_sdk.params import OnPollParams, MakeRequestParams, Params, Param
 from soar_sdk.models.container import Container
 from soar_sdk.models.artifact import Artifact
-from soar_sdk.action_results import ActionOutput, MakeRequestOutput
+from soar_sdk.action_results import ActionOutput, MakeRequestOutput, OutputField
 from soar_sdk.logging import getLogger
 
 logger = getLogger()
@@ -72,6 +72,27 @@ def test_empty_list_output(
     return []
 
 
+class JsonOutput(ActionOutput):
+    name: str = OutputField(example_values=["John", "Jane", "Jim"], column_name="Name")
+    age: int = OutputField(example_values=[25, 30, 35], column_name="Age")
+
+
+class TableParams(Params):
+    company_name: str = Param(column_name="Company Name", default="Splunk")
+
+
+@app.action(render_as="json")
+def test_json_output(params: Params, asset: Asset, soar: SOARClient) -> JsonOutput:
+    return JsonOutput(name="John", age=25)
+
+
+@app.action(render_as="table")
+def test_table_output(
+    params: TableParams, asset: Asset, soar: SOARClient
+) -> JsonOutput:
+    return JsonOutput(name="John", age=25)
+
+
 app.register_action(
     "actions.reverse_string:reverse_string",
     action_type="investigate",