topic extend-context of multiple columns at once in Cortex XSOAR Discussions

extend-context of multiple columns at once

EspenAbildgaard — Tue, 04 Oct 2022 08:42:07 GMT

Hi all.
I'm struggling a lot to solve a particular issue.
I am performing a Log analytics query which returns 4 columns (named AuthenticationRequirement, ResultType, ExternalUser and TrustedNetwork). The result could result in multiple rows with these 4 columns.

I want to map each of these columns to a separate key, but I don't find a suitable way to do this as they all come scrambled together in an unorganized matter.

This is what the raw-response looks like:

The optimal result I am looking for, is that each 4 of these columns are mapped to their own separate keys, matching the column names. The applicable row results will have to be stored inside it as well.

For example, the two rows with the result "0", which would be "tables.0.rows.0.1" and "tables.0.rows.1.1", should be stored inside / below the key "ResultType".

Does anyone have a smart solution for this?

I can get the result I want with extend-context if the query only gives me a single column, but I would rather run a single query than having to divide it into 4 separate queries.

The result I get from the task output when I run it in debugger looks like this:

PS: possible outputs for the task looks like this:

Re: extend-context of multiple columns at once

Ivetto — Mon, 13 Feb 2023 19:45:03 GMT

We could always try and figure out how to present it in the way you wish in the context, but is the end goal to present it in a table for an analyst or is the context the end goal in and an out of itself?

If the end goal is to present the data to an analyst I would recommend using the jsonToTable integration and seeing if that shows the data as you need it.

Let me know if you need further assistance.

Re: extend-context of multiple columns at once

EspenAbildgaard — Tue, 14 Feb 2023 07:14:06 GMT

The automation will perform a Kusto query (KQL), in which some data is returned. The desired outcome would be that the data I receive can easily be split so that I can perform a conditional task on them.
For example, the KQL query might return 4 columns, and I would want to extend-context to assign each of them to a particular key, which I then use for a conditional task.