parse error: " in non-quoted-field on list [phishing-inprocessHashList]

[Asmita.Asmita]

Hi, 

I encountered a parsing error while running the phishing playbook with the previously reported email. sharing the steps and input data for better understanding of this issue.

"Check Mail Hash In Process or Not" Playbook steps: 

1. Set HashIncidentCount to -1

2. Format Mail Hash

3. Get InProcess List

4. Get Incident ID

5. Get Incident Count

6. Check If Record Exists--->

If YES: Set New Incident Count

     Remove Existing Record for In Process State

    (listName: phishing-inprocessHashList

       listData: ${FormattedHash}/${HashIncidentID}/${HashIncidentCount}

       parse error on line 1, column 292908: bare " in non-quoted-field on list [phishing-inprocessHashList]

     Update New Record for In Process State and Complete the playbook

If NO: Set HashIncidentCounterNew to -1 and Complete the playbook

Is there anyone who could provide assistance with this issue?

[jfernandes1]

Hi @Asmita.Asmita, the error is pretty clear, there is an extra double quote in the listData input. You will need to check the data first. Maybe run a transformer to for format the text properly. Something like the below.

[Asmita.Asmita]

Hi,

Thanks for addressing the issue But there is no quote in the listData input and getting the error.

[Asmita.Asmita]

In addition, In the builtin command also not showing any quote.

[jfernandes1]

Hi @Asmita.Asmita, can you share the context values for the below fields? Screenshot of the context will help.

FormattedHash

HashIncidentID

HashIncidentCount

[Asmita.Asmita]

Hi @jfernandes1 , sharing the snapshot:

[jfernandes1]

Hi @Asmita.Asmita, I still think there is something wrong with the list data. Could you check again? The error also mentions the location. line 1, column 292908

Not sure how much more help I can be, the command work for me.