topic Re: Can't Append strings into incident.Hostnames in Cortex XSOAR Discussions

Can't Append strings into incident.Hostnames

F.Otero — Wed, 24 Jan 2024 16:41:05 GMT

Hi all!,

I'm having issues trying to update the incident.Hostnames field.

What I want to do:

I'm receiving an alert which involve different hostnamed, for the sake of simplicity and to track easier the incidents we want to add the hostnames to the incidentHostnames field:

As it is an array there shouldn't be any issue but when we perform.

How are we doing it

I'm using the setIncident built in Integration

The result of the transformer is the expected an array with two hosts:

But the incident field shows only the first one:

We've also stored the same variable, obtained using the same transformer in a context variable using the Set built in automation:

And the result is as expected:

Expected Result

The expected result is to have in incident.Hostnames the same as we have in popo, an array with both of the hostnames.

What are we getting

That, despite the Incident.Hostnames field is defined as an array, we are not able to update it.

Thanks a lot in advanced!!

BR,

Fer

Re: Can't Append strings into incident.Hostnames

jqamruddin — Wed, 24 Jan 2024 17:40:04 GMT

Hi,

This is potentially because the Get field transformer is only grabbing the first element of the array. Can you please try adding the StringifyArray transformer after the Get field transformer?

This should resolve the issue and append both of the elements in the hostnames incident field.

Re: Can't Append strings into incident.Hostnames

F.Otero — Thu, 25 Jan 2024 11:05:55 GMT

Hi there!

It was grabbing both the fields thus the other variable setted worked. But I found the solution and it goes along with your lines.

As per the documentation:

Multi select / Array: Includes two options a) Multi select from a pre-filled list b) An empty array field for the user to add one or more values as a comma-separated list. XSOAR Incident Fields

So not only I need to stringify, I need to append them comma separated!

Thanks a lot,

BR,

Fer