manage Null values

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

manage Null values

L4 Transporter

Hello,

I'm trying to create a dataframe from two lists from the context:

key1:

     0:value1

     1:null

     2:value3

 

key2:

     0:value1

     1:value2

     2:value3

 

When I call them using demisto.getContext(...), the null value is not passed, like if the key doesn't exist.

So my first list becomes, without a row:

key1:

     0:value1

     1:value3

 

How can I make XSOAR to detect this Null value, which appears in the context interface?

 

 

13 REPLIES 13

L4 Transporter

Hi @Josep ,

 

I tried to reproduce what you explained but I could not see the same results. Can you explain which commands do you use to create those lists and where do you see that list without a null value?

 

What I have done is as below:

1. Created a list with a null value: 

!Set key=test value=`["1",null,"3"]`

2.Read the key by using GetContext command and ['1', None, '3'] is returned

print(demisto.executeCommand("getContext", {"id":incident_id})[0]['Contents']['context']['test'])

3. Created another key by using SetCommand to make sure the null value is there and it created test2 key as same as test1.

demisto.setContext("test2", demisto.executeCommand("getContext", {"id":incident_id})[0]['Contents']['context']['test'])

gyldz_0-1689838778858.png

 

 




L4 Transporter

It's working for you😲. These nulls values are brought at the beginning when the incident is created. In my case, when I call the variable ${incident.test1} the null indexes are deleted:

test1:

0:1

1:3

 

I'm using it directly at a playbook, not in an automation

L3 Networker

I just tested as well, I created an incident with a field testnull and set a list with a null value for that field:
Screenshot 2023-07-21 at 10.45.31 AM.png

Then I ran a task in a playbook that set the context key test with the data from the testnull field:
Screenshot 2023-07-21 at 10.45.40 AM.png

That new test context key still contained the null value:
Screenshot 2023-07-21 at 10.45.59 AM.png

L4 Transporter

Sorry for replying so late. The "null" value used is not a string @amontminy, example:

Josep_0-1691487429493.png

When this null value is used directly in a task conditional it doesn't detects it as an empty value. How can I check if this value is null?

 

L4 Transporter

Hi @Josep ,

 

You can use a transformer which is "doesn't equal "and "value -> null". Please see the example below:

gyldz_0-1691491016685.png

gyldz_1-1691491030853.png

 

L4 Transporter

Didn't work in a conditional:

Josep_0-1691491525503.png

 

L4 Transporter

it should be "Doesn't Equal" operator not "Equals"

L4 Transporter

But I would like to check if a list of dicts has a null value. If I do the oposite, "doesn't equal" it will give me the ones that have value. I just want to check if one of them is "null".

 

L4 Transporter

I understand your need now. You can do it as below. StringfyArray and use In List Operator to check if the null is in the list.

gyldz_0-1691493773892.png

 

L4 Transporter

Nope, it didn't work. It just directly avoid to convert the null to an string. So "list_with_null" with "StringifyArray" are only the ones with value, null doesn't appear.

L4 Transporter

Strange, It works for me. I put a condition and tested it with different cases. If I set another field with stringifyArray Transform, the null values are not stripped from the list. 

gyldz_0-1691500894766.png

gyldz_1-1691500915690.png

 

 



L4 Transporter

Thanks for your help,

I don't know if it could be a server configuration which treats the null values differently.

The data used is the output of an xdr incident, the initial data fetched.

L3 Networker

Stuff under "incident" in the context is actually an incident field and not part of the context. Instead of using demisto.getContext what do you get if you use demisto.incidents() instead?

 

For the conditional, I am guessing you're going to want something like: filter by Not Defined + Count transformer, then in the condition check if the result is >= 0

  • 2770 Views
  • 13 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!