Problem with AppendindicatorFieldWrapper script

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Problem with AppendindicatorFieldWrapper script

L1 Bithead



When we run the appendIndicatorField task, the last IP address of an array never gets tagged. Please see the following examples for clarification:


Example 1: works fine

!appendIndicatorField indicatorsValues="" field="tags" fieldValue="BlockPA" using-brand="Builtin"


Example 2: tags IP, doesn't tag IP
!appendIndicatorField indicatorsValues="," field="tags" fieldValue="BlockPA" using-brand="Builtin"


Example 3: tags IP's,, doesn't tag IP

!appendIndicatorField indicatorsValues=",," field="tags" fieldValue="BlockPA" using-brand="Builtin"

We run the task as described in official documentation:
indicators_values: A comma-separated list of indicators values. For example, for IP indicators, ",".


Does anyone know if this is a bug or we are making some mistake here?




L4 Transporter

I'm not able to reproduce that on XSOAR 6.11300044, with all my Base and Common Packs up to date, works find for me. 


Would be worth at support ticket.

L2 Linker

Please check if there are any results for these searches in XSOAR's Threat Intel tab:

value:"" and tags:BlockPA
value:"" and tags:BlockPA

L1 Bithead

Hello everyone,


I would like to express my gratitude for your responses. I have some updates to share regarding this matter.


After conducting further tests, we have observed that this issue occurs randomly. In some cases, all the IP addresses in an array are tagged, while in others, there is one IP address that remains untagged. It is not always the last IP address in the array (apologies for the confusion); it could be any IP address. However, based on more than 10 tests, we can say that the problem never affects more than one IP address.


I attach an error example for evidence. 


In my opinion, this is a bug, and I believe that this task should generate an error when one IP address is not tagged.


Best regards.

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!