topic Re: No output in action in Cortex XSOAR Discussions

No output in action

Aurelien19 — Fri, 28 Jul 2023 09:01:36 GMT

In the "cybereason-get-sensor-id" task we manage to retrieve the sensor id for a given machine, but only in the result tab.

In fact, it looks like the integration doesn't return an output result, so we're not able to use the sensorId as an input further into the playbook.

Is there any workaround to retrieve the actual result of this task in the context data and how to do it ?

Thank you.

Re: No output in action

bhmurali — Fri, 28 Jul 2023 12:44:57 GMT

You can use extend-context under advanced tab.
https://xsoar.pan.dev/docs/playbooks/playbooks-extend-context

You can go to advanced tab, under extend-context, do something like “sensorid=.”

That will get all the info from raw-response into the key sensorid.

Documentation on extend context is linked for your reference.

Re: No output in action

Aurelien19 — Fri, 28 Jul 2023 13:06:57 GMT

Thank you for your reply,

I already tried using extend-context but the raw-response is equal to null when I put it in sensorId key.

Re: No output in action

bhmurali — Fri, 28 Jul 2023 13:14:14 GMT

Maybe because it’s not returned in that field or that structure. You can just run the command with raw-response=true

check the json returned to see what the correct path is.

if for example, sensorID is returned under the key response.id, then in extend-context, use sensorid=response.id

If you’re unsure, you can simply use dot as I showed which will return everything under the context key specified.

sensorinfo=. Would return everything from the returned request to the key sensorinfo

https://youtu.be/pnPES1xhqPk

You can also refer this training module on extend-context for reference in addition to the doc link I provided.

Re: No output in action

Aurelien19 — Fri, 28 Jul 2023 13:22:13 GMT

I've also tried sensordId=. in order to return the object from the root and I got null despite having values in the result tab while running my playbook.

However I tried running the command in the war room using raw-response parameter to check the object structure and the result is null too.

Re: No output in action

bhmurali — Fri, 28 Jul 2023 16:56:26 GMT

Looks like only readable output is being returned by the command. I would suggest wrapping it into an automation and parse the response to get your sensor ID to be set in context

Re: No output in action

Aurelien19 — Sat, 29 Jul 2023 09:55:12 GMT

Is there any documentation on these kind of process ?