- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
07-28-2023 02:01 AM
In the "cybereason-get-sensor-id" task we manage to retrieve the sensor id for a given machine, but only in the result tab.
In fact, it looks like the integration doesn't return an output result, so we're not able to use the sensorId as an input further into the playbook.
Is there any workaround to retrieve the actual result of this task in the context data and how to do it ?
Thank you.
07-28-2023 09:56 AM
Looks like only readable output is being returned by the command. I would suggest wrapping it into an automation and parse the response to get your sensor ID to be set in context
07-28-2023 05:44 AM
You can use extend-context under advanced tab.
https://xsoar.pan.dev/docs/playbooks/playbooks-extend-context
You can go to advanced tab, under extend-context, do something like “sensorid=.”
That will get all the info from raw-response into the key sensorid.
Documentation on extend context is linked for your reference.
07-28-2023 06:06 AM
Thank you for your reply,
I already tried using extend-context but the raw-response is equal to null when I put it in sensorId key.
07-28-2023 06:14 AM
Maybe because it’s not returned in that field or that structure. You can just run the command with raw-response=true
check the json returned to see what the correct path is.
if for example, sensorID is returned under the key response.id, then in extend-context, use sensorid=response.id
If you’re unsure, you can simply use dot as I showed which will return everything under the context key specified.
sensorinfo=. Would return everything from the returned request to the key sensorinfo
You can also refer this training module on extend-context for reference in addition to the doc link I provided.
07-28-2023 06:22 AM
I've also tried sensordId=. in order to return the object from the root and I got null despite having values in the result tab while running my playbook.
However I tried running the command in the war room using raw-response parameter to check the object structure and the result is null too.
07-28-2023 09:56 AM
Looks like only readable output is being returned by the command. I would suggest wrapping it into an automation and parse the response to get your sensor ID to be set in context
07-29-2023 02:55 AM
Is there any documentation on these kind of process ?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!