topic Re: Context key reorganize in Cortex XSOAR Discussions

Context key reorganize

Antanas — Thu, 13 Apr 2023 11:08:17 GMT

Hi!

I want to be able to manipulate context keys by selecting the keys I want, and moving them to upper level. E.g.: Assuming I have the following in the context:

I want to have a new context key with only Name and HairColor:

GetFields transformer seems to have similar functionality, however I cannot tell it to get subkeys, e.g. Appearance.Head.HairColor.

Any ideas?

Thanks,

Antanas

Re: Context key reorganize

michaelsysec242 — Thu, 13 Apr 2023 15:15:52 GMT

I believe you need to add more context to what you intend by "selecting the keys I want and moving them to the upper level". Why not just created a new context Upper-Level key? You can try running !Print with this value => ${ParentKey.[].appearance.head}, it should grab all the values you want. Then use !Set or !Setmultiplevalues depending on what works for you.

Let me know what works for you.

Re: Context key reorganize

chrking — Fri, 14 Apr 2023 03:08:32 GMT

A jmespath transformer can do this.

You can test your jmespath expression in the war room like this:

Then use it as a transformer:

And finally check the results in the context:

Also... John should maybe get his red eyes looked at, I'm not a doctor but that doesn't seem normal 🤣

Re: Context key reorganize

Antanas — Sun, 16 Apr 2023 06:46:41 GMT

Hi @chrking , this worked like a charm! Thanks a lot.

This was just a mock data, not to worry about someones red eyes, all are safe and healthy 🙂

Re: Context key reorganize

Antanas — Sun, 16 Apr 2023 06:50:07 GMT

Hi @michaelsysec242 ,

I think the problem with your suggested approach is that i can't output multiple keys in a singe query, therefore i wouldn't be able to properly set them into one key.

Anyways, the other suggestion was to use jmespath as a transformer, and that worked quite well.

Thanks!