topic Output JSON for Incident Mapping in Cortex XSOAR Discussions

Output JSON for Incident Mapping

Sean_L — Fri, 05 Mar 2021 20:41:43 GMT

Hi all,

We have several incidents that we need to work on the mapping of, but they are relatively rare and are not pulled from the (SplunkPy) integration often enough that they are in any of the events that we get when we do the mapping (6.0) and pull from the integration.

They have been classified correctly, and we have several instances in XSOAR, so what we would like to do is to export the JSON from an existing incident and load it into the mapper to map the fields.

We've tried several commands (PrintContext and DumpJSON) but neither seem to give us the incident entries.

How can we best export events as JSON to load into the mapper and map fields?

Thanks,

Sean

Re: Output JSON for Incident Mapping

ABurt — Fri, 05 Mar 2021 22:41:02 GMT

Hi Sean,

In your current mapper, do you map any unmapped fields into the labels in the context data?

Regards

Adam

Re: Output JSON for Incident Mapping

Sean_L — Sun, 07 Mar 2021 18:14:32 GMT

Yes we do

Re: Output JSON for Incident Mapping

ABurt — Mon, 08 Mar 2021 12:19:35 GMT

You could export an existing incident and make the labels the main fields on the incident and use this JSON as a file input into the mapping.

For example, create an automation script called "exportIncidentLabels" and use the following code:

incident = demisto.incident().get('labels', {}) parsed_incident = dict() for item in incident: parsed_incident[item['type']] = item['value'] demisto.results([json.dumps(parsed_incident)])

Then execute it from the war room of the desired incident that contains the relevant labels. When the results show, download them as a file:

Then open the mapper and use:

However you get the data out, the mapper JSON input file expects a JSON list of dictionaries. Each array entry is considered a new incident and the JSON dictionary is considered the "rawJSON" input into an incident.

[

{

"incident1_field1": "value1",

"incident1_field2": "value2"

{

"incident2_field1": "value1",

"incident2_field2": "value2"

}

]

Re: Output JSON for Incident Mapping

Sean_L — Thu, 11 Mar 2021 18:04:42 GMT

So I finally got around to it and I added the script. It outputs the labels nicely. I ran them though CyberChef to make sure everything was correct, and there were no formatting issue, but when I upload in the Mapping Editor I get this:

Error parsing request

Request body is not well-formed. It must be JSON.

Error details

json: cannot unmarshal number into Go struct field queryDTOnList.list of type map[string]interface {}

This is the same message I get when I export from Splunk as JSON as well.

Re: Output JSON for Incident Mapping

Sean_L — Thu, 11 Mar 2021 18:09:28 GMT

I figured out. The JSON needs top be enclosed in '[' and ']' for it to work.

Adding this to the start and end of the file after the export from the script worked!

Thanks!