Avoid empty returns

r_buchwalder — Tue, 16 Feb 2021 10:37:33 GMT

Hello All

In my Playbook I run into an issue with empty returns.

My Playbook requests Cherwell with several hosts in an array: ["server-A","server-B"]

In Cherwell, "server-B" does not exist, so I do see that in the "Result Tab" of the Task, but the Output is only from the one Host (server-A), which is in the Cherwell DB.

The reason is, that I have to fill out later some other DB. And they fill me in both Servers (server-A and server-B) the same one content from Cherwell.

How do I avoid "empty" fields?

I'm looking for something like (If output = "no result" then ...)

But this must happen in the Cherwell-Task.

To understand:

Cherwell-Task:

Input:

["server-A","server-B"]

Result:

dbot request server-A:

a Table with contents of server-A

dbot request server-B:

"no results"

Output:

Cherwell.QueryResults [{ "stuff from server-A" }]

Next Task I see:

for [{"server-A","server-B"}] insert [{ cherwell-output }]

and cherwell-output contains only info from one server (server-A)

and this Task inserts the content of server-A in both targets (server-A and server-B)

How may I bring this "no entry" into this whole loop?

I hope my question is clear... 🙂

thanks

roger

Re: Avoid empty returns

gfilippov — Tue, 15 Jun 2021 08:51:12 GMT

Hi,
By default if you query for something that wasn't found- it won't be written to the context, it is like this in pretty much all the integrations,
the Cherwell result should include the host name which you can use to verify if you got anything back regarding that host,
for example if you have an input of 10 hosts, but only some returned data from Cherwell; you can have a task\playbook that will loop the input host names one by one, and will check if it exists in the Cherwell response, if so it will write the data to the other DB, if not it will continue to the next one,
thanks.

topic Re: Avoid empty returns in Cortex XSOAR Discussions

Avoid empty returns

Re: Avoid empty returns