Can't Append strings into incident.Hostnames

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Can't Append strings into incident.Hostnames

L0 Member

Hi all!,

 

I'm having issues trying to update the incident.Hostnames field.

 

  • What I want to do:

I'm receiving an alert which involve different hostnamed, for the sake of simplicity and to track easier the incidents we want to add the hostnames to the incidentHostnames field:

FOtero_0-1706113371425.png

As it is an array there shouldn't be any issue but when we perform.

 

  • How are we doing it

I'm using the setIncident built in Integration

FOtero_1-1706113684985.png

The result of the transformer is the expected an array with two hosts:

FOtero_2-1706113857656.png

 

But the incident field shows only the first one:

FOtero_3-1706113963629.png

We've also stored the same variable, obtained using the same transformer in a context variable using the Set built in automation:

FOtero_4-1706114171884.png

And the result is as expected:

FOtero_5-1706114247117.png

 

  • Expected Result

The expected result is to have in incident.Hostnames the same as we have in popo, an array with both of the hostnames.

 

  • What are we getting

That, despite the Incident.Hostnames field is defined as an array, we are not able to update it.

 

Thanks a lot in advanced!!

 

BR,

Fer

 

 

 

 

1 accepted solution

Accepted Solutions

Hi there!

 

It was grabbing both the fields thus the other variable setted worked. But I found the solution and it goes along with your lines.

 

As per the documentation:

 

  • Multi select / Array: Includes two options a) Multi select from a pre-filled list b) An empty array field for the user to add one or more values as a comma-separated list. XSOAR Incident Fields 

 

So not only I need to stringify, I need to append them comma separated!

 

FOtero_0-1706180746358.png

 

 

Thanks a lot,

 

BR,

Fer

View solution in original post

2 REPLIES 2

L2 Linker

Hi, 

 

This is potentially because the Get field transformer is only grabbing the first element of the array. Can you please try adding the StringifyArray transformer after the Get field transformer? 

 

This should resolve the issue and append both of the elements in the hostnames incident field. 

 

Hi there!

 

It was grabbing both the fields thus the other variable setted worked. But I found the solution and it goes along with your lines.

 

As per the documentation:

 

  • Multi select / Array: Includes two options a) Multi select from a pre-filled list b) An empty array field for the user to add one or more values as a comma-separated list. XSOAR Incident Fields 

 

So not only I need to stringify, I need to append them comma separated!

 

FOtero_0-1706180746358.png

 

 

Thanks a lot,

 

BR,

Fer

  • 1 accepted solution
  • 1031 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!