topic Re: Nested variables in XSOAR ? Interpolation? in Cortex XSOAR Discussions

Nested variables in XSOAR ? Interpolation?

kbratt — Wed, 06 Mar 2024 23:39:12 GMT

I would like to use a Context key Value as a variable in a task, is this possible, or how are people accomplishing this in XSOAR? Do i need to create a custom script? I saw someone else mention they were able to do something similar with Lists, but I am not sure how that would work.

For Example:

ContexKey1 : ContextKey2.Key

ContextKey2.Key : NeededValue

In my task I need to be able to reference ContextKey1 in a task, to get the value of ContextKey2.Key, which above = NeededValue

Ideally the command : !Set key:Results value:${${ContextKey1}}

would produce : Results:NeededValue

But that doesn't work.

Any advice would be appreciated, thanks

Re: Nested variables in XSOAR ? Interpolation?

madani — Thu, 07 Mar 2024 12:55:58 GMT

Is the name of your ContextKey2 fixed or variable ?

Because I do something similar at what you want :

Context = { "ContextKey1":"qwerty", "ContextKey2":{ "azerty":True, "qwerty":False } }

And I use transformer on the task argument

Get : ContextKey2
transformat get field ${Key1}

Otherwise if the ContextKey2 name can change, you need to write an automation to use the demisto.context()
Also I think your situation will be easier if you have "ContexKey1":Key instead of "ContexKey1":ContextKey2.Key

Re: Nested variables in XSOAR ? Interpolation?

kbratt — Thu, 07 Mar 2024 19:56:03 GMT

Thanks for the response!

The second Context key name does change, that is why I am passing it in as a value to the first Static Context Key name.
The Second Context key is a result of a Task in the playbook, and it changes per incident but the value of ContextKey1 is passed in at incident creation time

ContextKey1 name is static, and it will contain the path to the second context key that I need (which changes per incident)

Example 1: Context = { "ContextKey1":"Search.Results.User", "Search.Results.User":"usernameexample" } Example 2: Context = { "ContextKey1":"Search.Results.Computer", "Search.Results.Computer":"computernameexamle" }

So I need to be able to build a playbook that will have a task that looks at "ContextKey1", but it will pull the value from Search.Results.User in Example incident 1 and Search.Results.Computer in Example incident 2.
Hope that makes sense.
I think I have this working in a custom script, so may just go that way.