topic Re: Assigning an array of Values to a key/variable in Cortex XSOAR Discussions

Assigning an array of Values to a key/variable

vidurasupun — Wed, 13 Jul 2022 07:57:19 GMT

Hey guys,

I'm working on separating internal and external IP(s) on a playbook and I want to use those values in a email body. So currently I'm using a temporary list to store IP(s) then call when needed in the same playbook with ${lists.templist}. But I have two limitations with this approach,

Cannot add more than one IP, as setList fails.
Uncertain about what will happen if the playbook runs simultaneously on two different incidents.

If someone has a less messy method, please let me know.

Re: Assigning an array of Values to a key/variable

Sec101 — Wed, 13 Jul 2022 13:34:49 GMT

Not sure you can do a list and assign it to a variable. Thinking you would have to identify a device group first, and the serial number of the firewall, and then assign a specific variable to that. The firewalls/panorama is looking for a specific address/single address/entry for any given spot on a variable assigned to a device.

Re: Assigning an array of Values to a key/variable

jfernandes1 — Thu, 14 Jul 2022 00:52:37 GMT

Hi @vidurasupun, not sure what your use case is, I can help better if I understand what exactly your trying to do.

By list I'm assuming your referring to a list of values in the incident's context? Not the external list function of Cortex https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-8/cortex-xsoar-admin/lists? The command setList is used for that.

Try the attached playbook, it should do the trick. It uses an inbuilt conditional check and playbook looping to achieve the same outcome. You can also do this with a single automation.

I had to change the extensions to xml, just change it back to yml before uploading to your server.

Re: Assigning an array of Values to a key/variable

vidurasupun — Thu, 14 Jul 2022 05:55:27 GMT

Sec101 thank you for the response but I need to do the same thing on the playbook level, as Jfernandes1 mentioned he is using the set automation to assign external IP(s) to the key externalIPs then I can call it later in my playbook as an example to send a mail like below.

Hi Network Team,

Please block the IP(s) ${externalIPs} from the FW.

@jfernandes1

Re: Assigning an array of Values to a key/variable

vidurasupun — Thu, 14 Jul 2022 05:55:49 GMT

Thank you for the solution. I added bit of stuff on top your playbook,

extractIndicators automation to extract the IP(s) from the incident.
Setting IP = IP.Address to give the input to rangeloop.