topic Re: Build transformer with execute.command() in Cortex XSOAR Discussions

Build transformer with execute.command()

SanDev — Fri, 31 Mar 2023 13:39:35 GMT

Hello,

I'm trying to build a transformer that given a IP gives back the reverse dns. However, it seems that using commands in transformers is not allowed. Am I wrong?

Re: Build transformer with execute.command()

michaelsysec242 — Mon, 03 Apr 2023 09:02:56 GMT

Can you provide some more context and examples so we can better understand the issue? In general, you can use a transformer in an automation script and then save the object under a new variable. Once completed you can run the command with the transformed data object. Just so that you understand the term transform is used to convert data into other types or forms such as strip() and Regex. You can run the command with the data.

Re: Build transformer with execute.command()

SanDev — Mon, 03 Apr 2023 20:32:41 GMT

Hello Michael,

Automation scripts can be tagged as "Transformer". This allows you to use them as transformer inside "filters and transformers" when a variable is set.

My problem is that I can perfectly create a transformer and make it work, however when I try to use an "execute.command" like Dig (execute.command("Dig", ....)) inside the automation tagged with "Transformer", the transformer doesn't work.

The main question is why is not working? Is not allowed to use "execute.command" in an automation used as a "transformer"?

Re: Build transformer with execute.command()

kwatsontutoring — Thu, 12 Dec 2024 15:39:38 GMT

Has there been any update on this? I am facing the same issue. I was hoping to use:
// Some code to gerate a splunk query

matches = execute_command(

"splunk-search",

{

"query": splunk_query,

"using": "SplunkCloud",

)

// Some code to format the output of the query
as a transformer. Ideally this will be used in a mapper to identify certain alerts in preprocessing rules.