- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-06-2024 03:37 PM - edited 03-06-2024 03:39 PM
I would like to use a Context key Value as a variable in a task, is this possible, or how are people accomplishing this in XSOAR? Do i need to create a custom script? I saw someone else mention they were able to do something similar with Lists, but I am not sure how that would work.
For Example:
ContexKey1 : ContextKey2.Key
ContextKey2.Key : NeededValue
In my task I need to be able to reference ContextKey1 in a task, to get the value of ContextKey2.Key, which above = NeededValue
Ideally the command : !Set key:Results value:${${ContextKey1}}
would produce : Results:NeededValue
But that doesn't work.
Any advice would be appreciated, thanks
03-07-2024 04:55 AM
Is the name of your ContextKey2 fixed or variable ?
Because I do something similar at what you want :
Context = {
"ContextKey1":"qwerty",
"ContextKey2":{
"azerty":True,
"qwerty":False
}
}
And I use transformer on the task argument
Get : ContextKey2
transformat get field ${Key1}
Otherwise if the ContextKey2 name can change, you need to write an automation to use the demisto.context()
Also I think your situation will be easier if you have "ContexKey1":Key instead of "ContexKey1":ContextKey2.Key
03-07-2024 11:56 AM
Thanks for the response!
The second Context key name does change, that is why I am passing it in as a value to the first Static Context Key name.
The Second Context key is a result of a Task in the playbook, and it changes per incident but the value of ContextKey1 is passed in at incident creation time
ContextKey1 name is static, and it will contain the path to the second context key that I need (which changes per incident)
Example 1:
Context = {
"ContextKey1":"Search.Results.User",
"Search.Results.User":"usernameexample"
}
Example 2:
Context = {
"ContextKey1":"Search.Results.Computer",
"Search.Results.Computer":"computernameexamle"
}
So I need to be able to build a playbook that will have a task that looks at "ContextKey1", but it will pull the value from Search.Results.User in Example incident 1 and Search.Results.Computer in Example incident 2.
Hope that makes sense.
I think I have this working in a custom script, so may just go that way.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!