topic Re: Extract IP's from context data in Cortex XSOAR Discussions

Extract IP's from context data

SOAR-ADMIN — Mon, 11 Mar 2024 10:27:45 GMT

Hi Team,
we want to extract and check the IP reputation of IP's from a context data value which consists of 70k IP's from EDL and i just need 1000 IP's from that context value. Could you please assist us ..? please find the attachment

Re: Extract IP's from context data

asawyer — Mon, 11 Mar 2024 22:44:04 GMT

Hi @SOAR-ADMIN – I see you already have your list of IPs stored in the ${MatchRegex.results} context key. If you only need to get the first 1000 IPs from the list, you can use the out-of-the-box GetRange transformer on that context key to only get the specified range of values.

When doing large-volume indicator enrichment like this, it is a good idea to break the input data into batches, as you are planning to do, to avoid overloading your server. Make sure quiet mode is turned on and indicator extraction is turned off on the enrichment task.

Re: Extract IP's from context data

SOAR-ADMIN — Tue, 12 Mar 2024 06:04:28 GMT

Thanks Asawyer for your Reply, Could you suggest some free Threat intel platform from marketplace to enrich those IP's additionally which command should be used to remove duplicate IP's from that list ...?

Re: Extract IP's from context data

asawyer — Fri, 22 Mar 2024 22:38:48 GMT

@SOAR-ADMIN You can filter the Marketplace on "Free Enricher" to find publicly available threat intel integrations.

To dedup a list, use the Unique transformer.