Output JSON for Incident Mapping

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Output JSON for Incident Mapping

L1 Bithead

Hi all,

We have several incidents that we need to work on the mapping of, but they are relatively rare and are not pulled from the (SplunkPy) integration often enough that they are in any of the events that we get when we do the mapping (6.0) and pull from the integration.

 

They have been classified correctly, and we have several instances in XSOAR, so what we would like to do is to export the JSON from an existing incident and load it into the mapper to map the fields. 

 

We've tried several commands (PrintContext and DumpJSON) but neither seem to give us the incident entries.

 

How can we best export events as JSON to load into the mapper and map fields?

 

Thanks,

Sean

1 accepted solution

Accepted Solutions

You could export an existing incident and make the labels the main fields on the incident and use this JSON as a file input into the mapping.

 

For example, create an automation script called "exportIncidentLabels" and use the following code:


 

incident = demisto.incident().get('labels', {})
parsed_incident = dict()

for item in incident:
    parsed_incident[item['type']] = item['value']

demisto.results([json.dumps(parsed_incident)])

 

Then execute it from the war room of the desired incident that contains the relevant labels. When the results show, download them as a file:

 

ABurt_0-1615205436695.png

 

ABurt_1-1615205468654.png

 

ABurt_2-1615205499328.png

 

 

Then open the mapper and use:

ABurt_3-1615205576784.png

 

ABurt_4-1615205646092.png

 

 

 

However you get the data out, the mapper JSON input file expects a JSON list of dictionaries. Each array entry is considered a new incident and the JSON dictionary is considered the "rawJSON" input into an incident.

 

[

{

    "incident1_field1": "value1",

    "incident1_field2": "value2"

},

{

    "incident2_field1": "value1",

    "incident2_field2": "value2"

}

]

 

View solution in original post

5 REPLIES 5

L3 Networker

Hi Sean,

 

In your current mapper, do you map any unmapped fields into the labels in the context data?

 

Regards

 

Adam

 

 

Yes we do

You could export an existing incident and make the labels the main fields on the incident and use this JSON as a file input into the mapping.

 

For example, create an automation script called "exportIncidentLabels" and use the following code:


 

incident = demisto.incident().get('labels', {})
parsed_incident = dict()

for item in incident:
    parsed_incident[item['type']] = item['value']

demisto.results([json.dumps(parsed_incident)])

 

Then execute it from the war room of the desired incident that contains the relevant labels. When the results show, download them as a file:

 

ABurt_0-1615205436695.png

 

ABurt_1-1615205468654.png

 

ABurt_2-1615205499328.png

 

 

Then open the mapper and use:

ABurt_3-1615205576784.png

 

ABurt_4-1615205646092.png

 

 

 

However you get the data out, the mapper JSON input file expects a JSON list of dictionaries. Each array entry is considered a new incident and the JSON dictionary is considered the "rawJSON" input into an incident.

 

[

{

    "incident1_field1": "value1",

    "incident1_field2": "value2"

},

{

    "incident2_field1": "value1",

    "incident2_field2": "value2"

}

]

 

So I finally got around to it and I added the script.  It outputs the labels nicely.  I ran them though CyberChef to make sure everything was correct, and there were no formatting issue, but when I upload in the Mapping Editor I get this:

 

Error parsing request

Request body is not well-formed. It must be JSON.
 
Error details
json: cannot unmarshal number into Go struct field queryDTOnList.list of type map[string]interface {}

 

 

This is the same message I get when I export from Splunk as JSON as well.

I figured out.  The JSON needs top be enclosed in '[' and ']' for it to work.

 

Adding this to the start and end of the file after the export from the script worked!

 

Thanks!

  • 1 accepted solution
  • 8603 Views
  • 5 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!