XSOAR CMDB - SQL issue

[tlmarques]

Hi everyone,

I'm trying to use Cortex XDR and Cortex XSOAR to build a basic CMDB
In my XSOAR playbook, I run an XDR XQL query, then try to insert the results into an SQL database using the sql-command automation.

The command looks like this:

INSERT INTO Devices (
  [hostname], [serial_number], [model], [MAC ADD], [IP Address],
  [Vendor], [Profile], [Type], [Operating System],
  [First Observed], [Last Observed], [Source Scan]
) VALUES (
  '${hostname}', '${serial_number}', '${model}', '${mac}', '${ip}',
  '${vendor}', '${profile}', '${profile_type}', '${OS_COMBINED}',
  '${first_seen_date}', '${last_activity}', '${_COLLECTOR_TYPE}'
)

My problem:
All values are being inserted as empty strings in the SQL table.Has anyone successfully used context variables like ${hostname} in sql-command?

Is there a correct way to pass data from the playbook context into the SQL insert?

Thanks in advance!

[asawyer · Accepted solution]

Hi @tlmarques – If the variables (the values with the ${ } syntax) are resolving to empty strings, this most likely indicates a problem with the context paths. To test the context paths, open context data and paste in the full value (including the ${ }) in the search bar at the top. This will show the exact value that will be returned. If it is unexpectedly blank, that indicates a problem with your path. If these are incident fields, you may have forgotten the incident. at the beginning of the path.