How to work on File Content collected from Azure blob in Playbook

[xdrengineer]

I am working on Playbook, where I need to update the content of Azure storage blob.

I have used the integration with Azure storage container, and I am able to get the file, but I am getting the file metadata only on PB context, and I see that the file itself added to the incident.

However, no direct access to the file content to edit/add/remove.

I see only an option to download the file manually from incident UI.

Is there a way to make this edit from the PB itself, and then I can update the blob again with the new edited file.

That the integration's doc for the connector I am using, https://xsoar.pan.dev/docs/reference/integrations/azure-storage-container#azure-storage-container-bl...

By @Enes Ozdemir.

[mbgonzalez]

Hello, 

The file has to be in the Warroom, downloaded from somewhere like !getfile or something like that. You can use the command !ReadFile, and enter the "EntryID" of the file. I do it the same as you with a list of IPs but from GCS.

[xdrengineer]

Thanks mbgonzalez for your reply,

I couldn't see from script input a way to append or edit the file content, however, I overcome this phase by extracting the IOCs I need from the file, and set it in a context Variable, then I am creating a file, and lastly updating the blob.

The issue I am facing now is that, the automation script I use to create the file "FilecreateandUploadV2" is looping over the entries of extracted Indicators, and creating file for each, I tried to tune the input with transformers, but no actual help on that, except with stringfy, but this breaks the list format, which is important for the blob.

I appreciate if anyone has a clue, how to make the file create script to take all the entries and append it to the file as list.

[mbgonzalez · Accepted solution]

I think you're facing the same issues as I did. I stringify the whole array, so the list shows like this:

Then I made an automation that transforms from this "stringified array" to a "line break list", that is the format expected for the external platform to be consumed:

'''
Este script transforma una string que antes era un array a un string con salto de linea de cada elemento:
from: [‘1’,‘2’,‘n’, …]
to:
1
2
n
…

- Para utilizar este script se deben agregar 2 argumentos: input_key y output_key.
- input_key es un array transformado a string, para eso se puede usar el automation "Stringify"

autor:
'''

input_key = demisto.args().get('input_key')
output_key = demisto.args().get('output_key')

raw_string = demisto.get(demisto.context(), input_key)

if not raw_string:
    return_error(f"No se encontró valor en el contexto para la key '{input_key}'.")

try:
    ip_list = json.loads(raw_string)
    if not isinstance(ip_list, list):
        return_error(f"El valor en '{input_key}' no es una lista válida.")
except Exception as e:
    return_error(f"Error al parsear string como lista JSON: {e}")

ip_output = '\n'.join(ip_list)

demisto.setContext(output_key, ip_output)
return_results(f"Se guardó la lista en el contexto bajo la key '{output_key}'.")

This expects 2 inputs: the key with the "stringified array" and an output key. For example, mine was "array-a-string" and the other "string-a-lista", which after execution, it looks like this in the context:

After that, you get the content of your file in that output key, so you can use FileCreateAndUploadV2 and then upload your blob:

[xdrengineer]

Thanks mbgonzalez you got the point to the exact issue I am facing.

I came up to the same state - using script - couple of days back, but was still thinking it could be done with only Transformers.

It seems it is easier to accept working with script than wasting more time on Transformer.

Thanks for your help, and contribution 🤝 😊