Extract data in value

[SOAR-ADMIN]

To extract the specified highlighted dictionary value from the context data mentioned below, which script command and transformer should be utilized....?

 [{'type': 'events_fetched', 'value': '1'}, {'type': 'rules', 'value': '[{"id":112363,"name":112363,"type":"CRE_RULE"}]'}, {'type': 'event_count', 'value': '1'}, {'type': 'magnitude', 'value': '5'}, {'type': 'log_sources', 'value': '[{"id":63,"name":"Custom Rule Engine-8 :: PDC-SR-iSCO01","type_id":18,"type_name":"EventCRE"}]'}, {'type': 'first_persisted_time', 'value': '2024-10-16T05:12:02+00:00'}, {'type': 'domain_id', 'value': '0'}, {'type': 'events', 'value': '[{"categoryname_category":"Critical","categoryname_highlevelcategory":"System","credibility":7,"destinationgeographiclocation":"other","destinationip":"0.0.0.0","destinationport":0,"destinationv6":"0:0:0:0:0:0:0:0","devicetime":"2024-10-16T05:12:01.350000+00:00","eventDirection":"L2R","eventcount":1,"logsourcename_logsourceid":"Custom Rule Engine-8 :: PDC-SR-iSCO01","logsourcetypename_devicetype":"Custom Rule Engine","magnitude":7,"postNatDestinationIP":"0.0.0.0","postNatDestinationPort":0,"postNatSourceIP":"0.0.0.0","postNatSourcePort":0,"preNatDestinationPort":0,"preNatSourceIP":"0.0.0.0","preNatSourcePort":0,"protocolname_protocolid":"HOPOPT","qiddescription_qid":"Generates when a critical device has not sent an event to the QRadar for over 2 hours.","qidname_qid":"Critical Devices not sending events","rulename_creEventList":["_Critical Devices not sending events","BB:NetworkDefinition: Honeypot like Addresses","_BB:TimeDefinition:Business Hours"],"severity":7,"sourceMAC":"00:00:00:00:00:00","sourcegeographiclocation":"other","sourceip":"172.28.152.21","sourceport":0,"sourcev6":"0:0:0:0:0:0:0:0","starttime":"2024-10-16T05:12:01.350000+00:00","utf8_payload":"_Critical Devices not sending events\\tGenerates when a critical device has not sent an event to the QRadar for over 2 hours.\\tLog source \'TVM-ADC-S001 @ 1XX.28.15.21 (1XX.28.15X.21X)\' has stopped emitting events\\t"}]'}, {'type': 'follow_up', 'value': 'false'}, {'type': 'severity', 'value': '7'}, {'type': 'policy_category_count', 'value': '0'}, {'type': 'offense_type', 'value': 'Source IP'}, {'type': 'inactive', 'value': 'false'}, {'type': 'status', 'value': 'OPEN'}, {'type': 'mirroring_events_message', 'value': 'All available events in the offense were fetched.'}, {'type': 'description', 'value': 'I_Critical Devices not sending events\n'}, {'type': 'last_updated_time', 'value': '2024-10-16T05:12:01.350000+00:00'}, {'type': 'device_count', 'value': '1'}, {'type': 'relevance', 'value': '4'}, {'type': 'offense_source', 'value': '172.28.152.21'}, {'type': 'security_category_count', 'value': '1'}, {'type': 'source_count', 'value': '1'}, {'type': 'remote_destination_count', 'value': '1'}, {'type': 'id', 'value': '196718'}, {'type': 'LinkToOffense', 'value': '}, {'type': 'destination_networks', 'value': '["other"]'}, {'type': 'source_network', 'value': 'RO.AD_Servers.Trivendrum_RO'}, {'type': 'categories', 'value': '["Critical"]'}, {'type': 'local_destination_count', 'value': '0'}, {'type': 'protected', 'value': 'false'}, {'type': 'category_count', 'value': '1'}, {'type': 'start_time', 'value': '2024-10-16T05:12:01.350000+00:00'}, {'type': 'credibility', 'value': '2'}, {'type': 'last_persisted_time', 'value': '2024-10-16T05:15:31+00:00'}, {'type': 'username_count', 'value': '0'}, {'type': 'flow_count', 'value': '0'}, {'type': 'source_address_ids', 'value': '["172.28.152.21"]'}]

[ysato]

hi @SOAR-ADMIN,

I would create a new task with automation Set. Key is the new variable name in context data that you want to set this value under.

This is how I have your data in context data. 

This is how I would setup Set task using transformer called RegexExtractAll. If you need \ and other characters at the front and the end of it, I would either modify regex or add another transformer called "concat" to add something at the front and/or the end.

I hope this helps!