When we run the appendIndicatorField task, the last IP address of an array never gets tagged. Please see the following examples for clarification:
Example 1: works fine
!appendIndicatorField indicatorsValues="220.127.116.11" field="tags" fieldValue="BlockPA" using-brand="Builtin"
Example 2: tags IP 18.104.22.168, doesn't tag IP 22.214.171.124
!appendIndicatorField indicatorsValues="126.96.36.199,188.8.131.52" field="tags" fieldValue="BlockPA" using-brand="Builtin"
Example 3: tags IP's 184.108.40.206,220.127.116.11, doesn't tag IP 18.104.22.168
!appendIndicatorField indicatorsValues="22.214.171.124,126.96.36.199,188.8.131.52" field="tags" fieldValue="BlockPA" using-brand="Builtin"
We run the task as described in official documentation: https://xsoar.pan.dev/docs/reference/scripts/appendindicator-field-wrapper
indicators_values: A comma-separated list of indicators values. For example, for IP indicators, "184.108.40.206,220.127.116.11".
Does anyone know if this is a bug or we are making some mistake here?
I would like to express my gratitude for your responses. I have some updates to share regarding this matter.
After conducting further tests, we have observed that this issue occurs randomly. In some cases, all the IP addresses in an array are tagged, while in others, there is one IP address that remains untagged. It is not always the last IP address in the array (apologies for the confusion); it could be any IP address. However, based on more than 10 tests, we can say that the problem never affects more than one IP address.
I attach an error example for evidence.
In my opinion, this is a bug, and I believe that this task should generate an error when one IP address is not tagged.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!