Setting a pre-processing rule

[YilmazDincer]

Hi all,

In a list field, I want to go through all indexes one by one and if there is *malware* in all indexes(malware execution, malware alert, malware), I want to drop it. However, I could not edit this in the "Conditions for Incoming Incident" field.
For example, how can I do it, considering that we have "tag" field?
"tag Contains malware" like that.

tag data is ['malware execution','malware alert', 'malware'].

[gyldz · Accepted solution]

Hi @YilmazDincer ,

Is that field not mapped and available in incident fields? If so, you can use filters. If you cannot use an incident field, you can achieve this by using a pre-processing script as below. If the script returns False, the incident will be dropped. This script assumes that the list is saved as a string. If it is already a list, you can eliminate the split part. The field name for the tags is assumed tags. Feel free to edit the script according to your environment.

try:
    tags =  demisto.incidents()[0]["CustomFields"]["tags"].split(",")
    for tag in tags:
        count = 0
        if "malware" in tag:
            count+=1
    if count > 0:
        demisto.results(False)
    else:
        demise.results(True)

except:
    demise.results(True)

I hope my answer helps.