Extract IP's from context data

[SOAR-ADMIN]

Hi Team,
we want to extract and check the IP reputation of IP's from a context data value which consists of 70k IP's  from EDL and i just need 1000 IP's from that context value. Could you please assist us ..?  please find the attachment 
Cortex XSOAR 

[asawyer · Accepted solution]

Hi @SOAR-ADMIN – I see you already have your list of IPs stored in the ${MatchRegex.results} context key. If you only need to get the first 1000 IPs from the list, you can use the out-of-the-box GetRange transformer on that context key to only get the specified range of values.

When doing large-volume indicator enrichment like this, it is a good idea to break the input data into batches, as you are planning to do, to avoid overloading your server. Make sure quiet mode is turned on and indicator extraction is turned off on the enrichment task.

[SOAR-ADMIN]

Thanks  Asawyer for your Reply, Could you suggest some free Threat intel platform from marketplace to enrich those IP's additionally which command should be used to remove duplicate IP's from that list ...?

[asawyer]

@SOAR-ADMIN You can filter the Marketplace on "Free Enricher" to find publicly available threat intel integrations.

To dedup a list, use the Unique transformer.