topic Re: parse error: " in non-quoted-field on list [phishing-inprocessHashList] in Cortex XSOAR Discussions

parse error: " in non-quoted-field on list [phishing-inprocessHashList]

Asmita.Asmita — Thu, 10 Aug 2023 07:47:07 GMT

Hi,

I encountered a parsing error while running the phishing playbook with the previously reported email. sharing the steps and input data for better understanding of this issue.

"Check Mail Hash In Process or Not" Playbook steps:

1. Set HashIncidentCount to -1

2. Format Mail Hash

3. Get InProcess List

4. Get Incident ID

5. Get Incident Count

6. Check If Record Exists--->

If YES: Set New Incident Count

Remove Existing Record for In Process State

(listName: phishing-inprocessHashList

listData: ${FormattedHash}/${HashIncidentID}/${HashIncidentCount}

parse error on line 1, column 292908: bare " in non-quoted-field on list [phishing-inprocessHashList]

Update New Record for In Process State and Complete the playbook

If NO: Set HashIncidentCounterNew to -1 and Complete the playbook

Is there anyone who could provide assistance with this issue?

Re: parse error: " in non-quoted-field on list [phishing-inprocessHashList]

jfernandes1 — Thu, 10 Aug 2023 21:48:58 GMT

Hi @Asmita.Asmita, the error is pretty clear, there is an extra double quote in the listData input. You will need to check the data first. Maybe run a transformer to for format the text properly. Something like the below.

Re: parse error: " in non-quoted-field on list [phishing-inprocessHashList]

Asmita.Asmita — Fri, 11 Aug 2023 01:40:02 GMT

Hi,

Thanks for addressing the issue But there is no quote in the listData input and getting the error.

Re: parse error: " in non-quoted-field on list [phishing-inprocessHashList]

Asmita.Asmita — Fri, 11 Aug 2023 01:49:54 GMT

In addition, In the builtin command also not showing any quote.

Re: parse error: " in non-quoted-field on list [phishing-inprocessHashList]

jfernandes1 — Fri, 11 Aug 2023 07:20:30 GMT

Hi @Asmita.Asmita, can you share the context values for the below fields? Screenshot of the context will help.

FormattedHash

HashIncidentID

HashIncidentCount

Re: parse error: " in non-quoted-field on list [phishing-inprocessHashList]

Asmita.Asmita — Fri, 11 Aug 2023 09:24:10 GMT

Hi @jfernandes1 , sharing the snapshot:

Re: parse error: " in non-quoted-field on list [phishing-inprocessHashList]

jfernandes1 — Mon, 14 Aug 2023 07:05:17 GMT

Hi @Asmita.Asmita, I still think there is something wrong with the list data. Could you check again? The error also mentions the location. line 1, column 292908

Not sure how much more help I can be, the command work for me.