- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-11-2024 10:22 AM
I'm trying to create a "dt" filter for use with the GenericPolling playbook. (https://xsoar.pan.dev/docs/playbooks/generic-polling)
The key I need to check for the existence of is
MsGraph.Alert.Evidence.[1].@odata\.type
(XSOAR automatically adds the "\" before ".type" as the period is part of the key name when copying the context path of the key)
with a value of
#microsoft.graph.security.analyzedMessageEvidence
Note that both the key and value contain periods, the key name starts with an @ symbol, and the value starts with an # symbol.
There are generally 3 entries in the "Evidence" array and each entry contains an "@odata.type" key. The specific value I need to find is usually in the second entry, but I need to assume that the value could be in any entry and that there could be more or less than 3 entries.
I have tried many ways to escape the special characters in both the key name and value, but everything comes back with "Nothing found".
${MsGraph.Alert.Evidence.[1].@odata\.type} will return the value as a "result:"
${MsGraph.Alert.Evidence.@odata\.type} returns "Nothing found." as does ${MsGraph.Alert.Evidence.\@odata\.type} and any other permutation or combination I have tried of wrapping the key name in parens (), single quotes '@odata\.type', or escaping the @ symbol with a "\".
I'm pretty sure the parsing issue is due to the key name starting with the @ symbol, but I'm just running up against a wall at this point.
Is this a "me" problem, or is this a limitation of the XSOAR DT language to query this data coming back from Microsoft?
Scrubbed Context JSON below.
09-11-2024 10:32 AM
In case it's relevant, the data is coming from the "msg-search-alerts" automation of the Microsoft Graph Security integration. (https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph)
The "msg-get-alert-details" automation can also retrieve the same data, but the search-alerts automation is easier to filter based on the incident ID which is included when the incident is fetched by XSOAR. In either case, the key name structure is the same from both automations.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!