Assigning an array of Values to a key/variable

[vidurasupun]

Hey guys,

I'm working on separating internal and external IP(s) on a playbook and I want to use those values in a email body. So currently I'm using a temporary list to store IP(s) then call when needed in the same playbook with ${lists.templist}. But I have two limitations with this approach,

1. Cannot add more than one IP, as setList fails.
2. Uncertain about what will happen if the playbook runs simultaneously on two different incidents.

If someone has a less messy method, please let me know.

[Sec101]

Not sure you can do a list and assign it to a variable.   Thinking you would have to identify a device group first, and the serial number of the firewall, and then assign a specific variable to that.   The firewalls/panorama is looking for a specific address/single address/entry for any given spot on a variable assigned to a device.

[jfernandes1 · Accepted solution]

Hi @vidurasupun, not sure what your use case is, I can help better if I understand what exactly your trying to do. 

By list I'm assuming your referring to a list of values in the incident's context? Not the external list function of Cortex https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-8/cortex-xsoar-admin/lists? The command setList is used for that. 

Try the attached playbook, it should do the trick. It uses an inbuilt conditional check and playbook looping to achieve the same outcome. You can also do this with a single automation. 

I had to change the extensions to xml, just change it back to yml before uploading to your server. 

[vidurasupun]

 Sec101 thank you for the response but I need to do the same thing on the playbook level, as Jfernandes1 mentioned he is using the set automation to assign external IP(s) to the key externalIPs then I can call it later in my playbook as an example to send a mail like below.

Hi Network Team,

Please block the IP(s) ${externalIPs} from the FW. 

@jfernandes1

@jfernandes1

[vidurasupun]

Thank you for the solution. I added bit of stuff on top your playbook,

 

1. extractIndicators automation to extract the IP(s) from the incident.
2. Setting IP = IP.Address to give the input to rangeloop.