topic Re: Remove file types from the context data in Cortex XSOAR Discussions

Remove file types from the context data

EStenning — Tue, 02 Jul 2024 15:26:29 GMT

We have been building a playbook to decrypt all encrypted attachments and detonate in a wildfire and Mimecast sanbox using their integrations. I am struggling currently to remove jpegs and pngs from the context data so they are not being sent to the sandbox for detonation. I have a condition that loops through all the files after pulling them down from mimecast and if there is a file type that is not supported i have a error capture for it which logs a ticket to the service desk. I have built in a task to deletecontext filtering on File.Info including png or jpeg but it is not removing them from the context data? Am i missing something ?

Re: Remove file types from the context data

AbelSantamarina — Tue, 02 Jul 2024 17:56:53 GMT

Hello @EStenning,

Can you please provide more context as to how are you processing the list of files? Are you using a sub-playbook loop? A custom automation?
If you're using a sub-playbook loop you can specify an input that takes in your files for detonation, and apply a filter when passing in the input, so that only files with extension different than png and jpeg will be passed in.

Thanks.

Re: Remove file types from the context data

EStenning — Wed, 03 Jul 2024 09:40:53 GMT

Hey, we are using a sub-playbook to loop over every file and decrypt them using custom automation as xsoar does not support many file types out of the box. I have placed a task after all files are downloaded from mimecast using the mimecast integration to delete context data for file.info that includes png or jpeg. It works and completes and says it cleared the keys successfully but when i look in the context data the files are still there..

Re: Remove file types from the context data

EStenning — Wed, 03 Jul 2024 17:56:12 GMT

I was using jpeg and not jpg.........