topic Re: Using IsRFC1918Address check on context in condition task in Cortex XSOAR Discussions

Using IsRFC1918Address check on context in condition task

KevinThys — Thu, 03 Mar 2022 16:13:08 GMT

Hi,

I'm trying to use the condition to check if incident.destinationip is an public IP. But when selecting from context incident.destinationip and then IsRFC1918Address you need to fill in something in the right side. I checked the automation script and that should return True or False. But When testing the condition it always returns not matching using else condition.

Any idea how to use this? I already tried False or 0 or null but seems never to select the condition yes and always goes with else.

Re: Using IsRFC1918Address check on context in condition task

akoppad — Thu, 03 Mar 2022 16:27:05 GMT

Hi,

Can you try using ${incident.destinationip} under Get in the condition. And see if it works?

Re: Using IsRFC1918Address check on context in condition task

KevinThys — Thu, 03 Mar 2022 16:41:08 GMT

That does not change the result.

Re: Using IsRFC1918Address check on context in condition task

akoppad — Thu, 03 Mar 2022 18:21:15 GMT

Can you please try changing the False value to True and switching the condition to "no". And try with a private Ip as input to check if it selects the "no" branch.

Re: Using IsRFC1918Address check on context in condition task

KevinThys — Thu, 03 Mar 2022 19:47:59 GMT

Tried but same result.

Re: Using IsRFC1918Address check on context in condition task

asawyer — Fri, 04 Mar 2022 00:25:53 GMT

Hi @KevinThys,

I get the same issue when trying to use this script as a condition operator. Could you open a support case for the issue so we can get it fixed?

As a workaround, you can detach or duplicate the IsRFC1918Address automation and add the tag Condition to it. Then, if you choose "Choose automation" as the conditional type, you should see IsRFC1918Address in the dropdown. You can then create two branches, True and False, off the conditional task. Please let us know if that works for you.