topic Re: Issue while usin 'JQ' Transformer in Cortex XSOAR Discussions

Issue while usin 'JQ' Transformer

NicolasTHOMAS — Mon, 17 Jul 2023 19:14:04 GMT

Hello,

I would like to use 'jq' Transformer as designed in a custom "Mapper", but it constantly says to me that error message, whatever I am testing :
===> "Result: Failed to execute jq. Error: the JSON object must be str, bytes or bytearray, not dict"

Event though I tried barely everything in order to be able to test it, as you would be able to see it on enclosed screenshot, and as well on the simplest example here : https://jqplay.org/s/JTzcQNL1ui2

I tried .category, ."category", .{"category"}, .["category"], [.category] and all variations, with the table as well or with .id, ."id", .'id'... etc...etc...etc...

Many thanks in advance for your reply and Best Regards,
Thomas Nicolas

Re: Issue while usin 'JQ' Transformer

gyldz — Tue, 18 Jul 2023 10:08:32 GMT

Hi @NicolasTHOMAS ,

Can I ask why you need JQ? If you click the Choose data path next to the field and click category the path will be automatically added and it will be valid for all JSON input for that specific mapper. If you explain what you are trying to achieve I can try to help further. Please see the below screenshot.

Re: Issue while usin 'JQ' Transformer

NicolasTHOMAS — Tue, 18 Jul 2023 12:09:18 GMT

Hello,

I would like to use JQ as we are fetching different incidents, with different fields to map, and I would like to do a dynamic mapping of @odata.comments[] tables our @odata.evidence[] (sometimes several evidences table, @odata.evidence[0], @odata.evidence[1], @odata.evidence[2])

Regards,
Thomas Nicolas

Re: Issue while usin 'JQ' Transformer

amontminy — Tue, 18 Jul 2023 17:33:49 GMT

That error looks like it wants you to use the stringify operator prior to using the jq operator. I wasn't able to test since I don't have that jq transformer in my instance. I was able to use the DT transformer to parse out that category.

Instead of using DT or jq or another transformer though, I would try to use classifiers and mappers to map the data as needed. You can classify the data into different incident types with a classifier. Once you have the different incident types, you can then use an incoming mapper to map the fields per incident type. Below you can see where I map the field Alert Category based on 2 different inputs depending on which incident type is created by the classifier.

Re: Issue while usin 'JQ' Transformer

NicolasTHOMAS — Tue, 18 Jul 2023 17:36:23 GMT

Ok, so you think it is not possible to parse a JSON array or a JSON Object ?

Re: Issue while usin 'JQ' Transformer

amontminy — Tue, 18 Jul 2023 17:45:31 GMT

Not with that jq transformer, that error seems like it wants the JSON as a string instead of a dictionary object. DT seems to be able to handle the JSON object without using stringify though.