topic Re: Cortex XSOAR integration in Cortex XSOAR Discussions

Cortex XSOAR integration

LStanley — Tue, 26 Apr 2022 09:49:01 GMT

Hi, I want to poll for Status that is nested under Results. See below example :

I have this output when running the command tn-get-question-result

Tanium.QuestionResult
{
"QuestionID": "455036",
"Results": [
{
"ComputerName": "WIN-KBR5CNLJK52.icdc-caas.local",
"Count": "1",
"ID": "1",
"ParentStatus": "Complete",
"Status": "Complete, All Patches Applied"
}
],
"Status": "Completed"
}

I want to poll the Status inside the Results(Complete,All patches applied).

I am writing this dt filter, but it seem does not work as expected
Tanium.QuestionResult(val.Results.Status !== 'Complete, All Patches Applied').QuestionID

I see many example are only check with direct output, does not check within another context
Tanium.QuestionResult(val.Status !== 'Completed').QuestionID

May I know how should I write the DT filter? or its is not possible to poll the value within another context?

Thank you.

Re: Cortex XSOAR integration

ABurt — Tue, 26 Apr 2022 10:39:32 GMT

Have you tried using the sub-playbook for 'Context Polling'?

Re: Cortex XSOAR integration

ABurt — Tue, 26 Apr 2022 11:23:39 GMT

Also, you may need to provide an index for the object in the 'Results' array. Something like 'Tanium.QuestionResult(val.Results.[0].Status !== 'Complete, All Patches Applied').QuestionID

Re: Cortex XSOAR integration

JOng39 — Wed, 27 Apr 2022 08:31:49 GMT

Hi, I configure as what suggested. But Im getting this warning message

Warning: no ids matching the dt condition were found. Verify that the condition is correct and that all ids have finished running.

Tanium:{} 2 items

Question:{} 1 item

ID:468354

QuestionResult:{} 3 items

QuestionID:468354

Results:[] 1 item

0:{} 5 items

ComputerName:WIN-KBR5CNLJK52.icdc-caas.local

Count:1

ID:1

ParentStatus:Complete

Status:Complete, All Patches Applied

Status:Completed

I attached the context for reference. Any suggestion?

Thank you