Unable to retrieve output value while using extended context

AlexandreBorgo — Wed, 29 Jun 2022 13:25:44 GMT

Hello team,

I'm trying to use the extended context feature to keep only the data I'm interrested in and put them where I need them to be.

The automation I'm using is infoblox-get-ip from Infoblox integration.

Here is the output of the automation:

I'm setting the following string in the Extended Context field (splitted on multiple lines for better visibility):

IpInformation.status=result.status::
IpInformation.network=result.network::
IpInformation.names=result.names::
IpInformation.site=result.extattrs.site.value::
IpInformation.macaddress=result.macaddress

I'm getting the following result (information is censored, InRange and Pivate come from another integration):

As you can see only some of the fields are present in the output.

The following fields are missing : macaddress and extattrs.site.value.

Moreover all fields comming from the extended context functionnality are arrays (insteal of single value as the real output, except for names).

Here are the full context printed:

{
"IpInformation": {
"status": [
"value"
],
"InRange": "value",
"names": [
"value",
"value",
"value"
],
"Private": "value",
"network": [
"value"
]
},
"Infoblox": {
"IP": {
"Status": "value",
"MacAddress": "value",
"ReferenceID": "value",
"Network": "value",
"LeaseState": "value",
"Objects": [
"value",
"value",
"value",
"value"
],
"IsConflict": false,
"Names": [
"value",
"value",
"value"
],
"NetworkView": "value",
"Extattrs": {
"Organization": {
"value": "value",
"inheritance_source": {
"_ref": "value"
}
},
"Site": {
"value": "value",
"inheritance_source": {
"_ref": "value"
}
}
},
"Usage": [
"value",
"DHCP"
],
"IpAddress": "value",
"DhcpClientIdentifier": "value",
"Types": [
"value",
"value",
"value",
"value"
]
}
}
}

My questions are :

Am I using the right string in Extended Context to get the fields I want?
Is it possible to extract the single value instead of arrays?

Thank you for reading and your help on this topic.

Re: Unable to retrieve output value while using extended context

jfernandes1 — Thu, 30 Jun 2022 03:15:46 GMT

Hi @AlexandreBorgo, You cannot select the array items inside extended context. Just dump all the data to context and then use what you need. Use the command like below.

!infoblox-get-ip extend-context=data=

topic Unable to retrieve output value while using extended context in Cortex XSOAR Discussions

Unable to retrieve output value while using extended context

Re: Unable to retrieve output value while using extended context