topic Re: Extracting fields from Context/JSON in Playbook in Cortex XSOAR Discussions

Extracting fields from Context/JSON in Playbook

MMohammad12 — Thu, 06 Mar 2025 14:44:58 GMT

Hello,

I want to use the "GetFailedTasks" built-in automation to take some actions on the failed tasks and playbooks. The challenge i'm facing is parsing off fields from the output of the "GetFailedTasks" in playbook, namely "Task ID" and "Task Name" fields.

The output is JSON dict, below is sample output of three failed tasks:

[
{
"Command Name": "SetGridField",
"Brand Name": null,
"Incident Owner": "xxx@xx.com",
"Task Name": "updategrid-02",
"Command Description": "Creates a Grid table from items or key-value pairs.",
"Incident ID": "73773",
"Playbook Name": "xx-PB03-XSOAR-Monitor Playbook Failed Tasks.",
"Incident Created Date": "2025-02-25T12:05:58.490512072+01:00",
"Task ID": "5",
"Number of Errors": 18
},
{
"Command Name": "cisco-spark-create-message",
"Brand Name": null,
"Incident Owner": "",
"Task Name": "Send cisco webex message",
"Command Description": "Posts a plain text message, and optionally, a media content attachment, to a room.",
"Incident ID": "73921",
"Playbook Name": "FT - Darktrace Model Breaches (2025.01)",
"Incident Created Date": "2025-02-28T09:46:26.612020922+01:00",
"Task ID": "161",
"Number of Errors": 7
},
{
"Command Name": "cisco-spark-create-message",
"Brand Name": null,
"Incident Owner": "",
"Task Name": "Send cisco webex message",
"Command Description": "Posts a plain text message, and optionally, a media content attachment, to a room.",
"Incident ID": "73923",
"Playbook Name": "FT - Darktrace Model Breaches (2025.01)",
"Incident Created Date": "2025-02-28T09:51:26.562991852+01:00",
"Task ID": "161",
"Number of Errors": 6
}
]

What i did so far

- Created playbook, first task calls the automations script "GetFailedTasks" and extends context with value "failed_tasks" so that i use it in the second task

- The second task, i use parsejson function, and i invoke the failed_tasks with ( .Task ID)

The output of the first task is

However, the output of the second task is empty, it cannot extract the json field "Task ID"

What went wrong here

What is the best way to extract fields of json dict ( maybe nested)

Re: Extracting fields from Context/JSON in Playbook

ricardo.j.mateus — Fri, 07 Mar 2025 11:02:25 GMT

Hey, could you show the context data after the execution of those tasks? I suspect that the result from the 1st task is already a dictionary so no parsing is needed.

If it isn't and you have something like " failed_tasks: 'json_value_as_string_here' ", I believe just simply doing !ParseJSON value=${failed_tasks} should work.

Re: Extracting fields from Context/JSON in Playbook

cbrake1 — Fri, 07 Mar 2025 21:24:32 GMT

Hi Mohammad,

You should be able to reference the list of task names with ${GetFailedTasks.Task Name}, and Task ID's with ${GetFailedTasks.Task ID} without the need for extend-context or ParseJSON, since the output should already be json-formatted - list of dictionaries.
If those keys don't get you the data in the format you're looking for, I can help with determining further steps to transform it

Re: Extracting fields from Context/JSON in Playbook

MMohammad12 — Mon, 17 Mar 2025 11:29:55 GMT

@cbrake1 , thanks , that worked. However now i am running into another issue.

The goal here is to populate a grid in the incident layout with a set of data. The first set of data is successfully populated from the GetFailedTasks Context path.

I want to add a field "playbook URL" to the grid. The field is parsed and transformed properly based on the previous post, so what i did:

- i added a column (Playbook URL) to the Grid incident field config (see screenshot 1), for some reason this doesn't show up at all in the layout (screenshot 2). I even created a new grid but it didn't take the new column. Even when i open the layout config it doesn't recognize the field. Any conditions or restrictions to adding column to grid ?

My plan is once i get that column added to the grid, i will invoke a second SetGridField task in the playbook to populate the new field, as every "setGridField" points to one ContextPath.

Your help is appreciated !!