topic Get/modify nested JSON list value in Cortex XSOAR Discussions

Get/modify nested JSON list value

Josep — Thu, 29 Sep 2022 11:10:06 GMT

Hello,

There's a list in json format named "domainUrlStatus":

{"domain1.com": {

"url1.com": {

"status": "up",

"date": "date"

"url2.com": {

"status": "down",

"date": "date"

}

"domain2.com": {

"url3.com": {

"status": "up",

"date": "date"

"url4.com": {

"status": "down",

"date": "date"

}

How can the values be reached(think about the "." in the urls)?

How can I add a new value like "url5.com" inside "domain1.com"?

How to modify one of the last values? (like status)

How to check if a domain exists in all the json?

Trying to avoid using own automations, only using tasks

Re: Get/modify nested JSON list value

jfernandes1 — Fri, 30 Sep 2022 03:20:47 GMT

Hi @Josep,

You'll need to escape the dot. Example below.

${domain\.com.url1\.com.status}

Let me know if this works for you.

Re: Get/modify nested JSON list value

Josep — Fri, 30 Sep 2022 06:18:48 GMT

Thanks for the reply,

so I should create a task that adds an "\" before the dot for each variable.

Re: Get/modify nested JSON list value

jfernandes1 — Tue, 04 Oct 2022 01:39:54 GMT

Hi @Josep.,

Sorry I don't see any way to make changes to the keys. You might need to try different escape sequences, but I was unable to find one. Also, passing the "\" to the deleteContext automation seems to break it and creates a context context entry.

You could try passing the entire object into a python automation, but Python's JSON library might throw a schema error. Could you let me know which automation or integration is creating this context entry?

Re: Get/modify nested JSON list value

Josep — Tue, 04 Oct 2022 07:35:27 GMT

Yes, I'd many problems. First calling directly a variable of the list(json), like "${list}.${domain\.com.url1\.com.status}", this does not work. I need to put the Json inside the context

Second, what you said, I couldnt make changes to the keys, it was a mess, I had to convert them and then put them inside, not possible.

So finally, I made it work just doing an automation in python from zero.

Load json:

allJSON = demisto.executeCommand("getList", {"listName":"domainUrlStatus"})
data = json.loads(allJSON[0]['Contents'])

Obtain the status given a domain and an url:

status = data[domain][url]["status"]

Change the status:

data[domain][url]["status"] = newStatus

Save the change on the JSON:

demisto.executeCommand("setList",{"listName":"domainUrlStatus""listData":data})

It's a pity that something so simple can't be done with simple tasks.