manage Null values

[Josep]

Hello,

I'm trying to create a dataframe from two lists from the context:

key1:

     0:value1

     1:null

     2:value3

key2:

     0:value1

     1:value2

     2:value3

When I call them using demisto.getContext(...), the null value is not passed, like if the key doesn't exist.

So my first list becomes, without a row:

key1:

     0:value1

     1:value3

How can I make XSOAR to detect this Null value, which appears in the context interface?

[gyldz]

Hi @Josep ,

I tried to reproduce what you explained but I could not see the same results. Can you explain which commands do you use to create those lists and where do you see that list without a null value?

What I have done is as below:

1. Created a list with a null value: 

!Set key=test value=`["1",null,"3"]`

2.Read the key by using GetContext command and ['1', None, '3'] is returned

print(demisto.executeCommand("getContext", {"id":incident_id})[0]['Contents']['context']['test'])

3. Created another key by using SetCommand to make sure the null value is there and it created test2 key as same as test1.

demisto.setContext("test2", demisto.executeCommand("getContext", {"id":incident_id})[0]['Contents']['context']['test'])

[Josep]

It's working for you😲. These nulls values are brought at the beginning when the incident is created. In my case, when I call the variable ${incident.test1} the null indexes are deleted:

test1:

0:1

1:3

I'm using it directly at a playbook, not in an automation

[amontminy]

I just tested as well, I created an incident with a field testnull and set a list with a null value for that field:

Then I ran a task in a playbook that set the context key test with the data from the testnull field:

That new test context key still contained the null value:

[Josep]

Sorry for replying so late. The "null" value used is not a string @amontminy, example:

When this null value is used directly in a task conditional it doesn't detects it as an empty value. How can I check if this value is null?

[gyldz]

Hi @Josep ,

You can use a transformer which is "doesn't equal "and "value -> null". Please see the example below:

[Josep]

Didn't work in a conditional:

[gyldz]

it should be "Doesn't Equal" operator not "Equals"

[Josep]

But I would like to check if a list of dicts has a null value. If I do the oposite, "doesn't equal" it will give me the ones that have value. I just want to check if one of them is "null".

[gyldz]

I understand your need now. You can do it as below. StringfyArray and use In List Operator to check if the null is in the list.

[Josep]

Nope, it didn't work. It just directly avoid to convert the null to an string. So "list_with_null" with "StringifyArray" are only the ones with value, null doesn't appear.

[gyldz]

Strange, It works for me. I put a condition and tested it with different cases. If I set another field with stringifyArray Transform, the null values are not stripped from the list. 

[Josep]

Thanks for your help,

I don't know if it could be a server configuration which treats the null values differently.

The data used is the output of an xdr incident, the initial data fetched.

[chrking]

Stuff under "incident" in the context is actually an incident field and not part of the context. Instead of using demisto.getContext what do you get if you use demisto.incidents() instead?

For the conditional, I am guessing you're going to want something like: filter by Not Defined + Count transformer, then in the condition check if the result is >= 0