Nested variables in XSOAR ? Interpolation?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Nested variables in XSOAR ? Interpolation?

L1 Bithead

I would like to use a Context key Value as a variable in a task, is this possible, or how are people accomplishing this in XSOAR?  Do i need to create a custom script? I saw someone else mention they were able to do something similar with Lists, but I am not sure how that would work. 

 

For Example: 

 

ContexKey1 : ContextKey2.Key

ContextKey2.Key : NeededValue

 

In my task I need to be able to reference ContextKey1 in a task, to get the value of ContextKey2.Key, which above = NeededValue

 

Ideally the command : !Set key:Results value:${${ContextKey1}} 

would produce : Results:NeededValue

But that doesn't work. 

 

Any advice would be appreciated, thanks

2 REPLIES 2

L1 Bithead

Is the name of your ContextKey2 fixed or variable ?

Because I do something similar at what you want :

 

 

Context = {
  "ContextKey1":"qwerty",
  "ContextKey2":{
   "azerty":True,
   "qwerty":False
 }
}

 

And I use transformer on the task argument

Get : ContextKey2
transformat get field ${Key1}


Otherwise if the ContextKey2 name can change, you need to write an automation to use the demisto.context()
Also I think your situation will be easier if you have "ContexKey1":Key instead of "ContexKey1":ContextKey2.Key

M.A. Engineer XSOAR

L1 Bithead

Thanks for the response!

 

The second Context key name does change, that is why I am passing it in as a value to the first Static Context Key name. 
The Second Context key is a result of a Task in the playbook, and it changes per incident but the value of ContextKey1 is passed in at incident creation time

ContextKey1 name is static, and it will contain the path to the second context key that I need (which changes per incident) 

 

Example 1: 
Context = {
  "ContextKey1":"Search.Results.User",
  "Search.Results.User":"usernameexample"
 }

Example 2: 
Context = {
  "ContextKey1":"Search.Results.Computer",
  "Search.Results.Computer":"computernameexamle"
 }

 

So I need to be able to build a playbook that will have a task that looks at "ContextKey1", but it will pull the value from Search.Results.User in Example incident 1 and Search.Results.Computer in Example incident 2. 
Hope that makes sense. 
I think I have this working in a custom script, so may just go that way. 

  • 736 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!