About Antanas

Hi @ABurt , This does exactly what I needed, thanks! I generalized your script to be used not only for IP's and added additional input variables. I'm pasting the updating code for the reference if anyone wants to reuse it. Many thanks again! commonfields: id: b343683b-cc7a-4481-82d4-e089cf52e41c version: 32 vcShouldKeepItemLegacyProdMachine: false name: Split script: |- # Get the arguments args = demisto.args() items = args.get('items') maxitems = args.get('maxitems') set_count=int(maxitems) output_key = args.get('outputkey') # Check that the input is either an array or can be split if not isinstance(items, list): try: items = items.split(",") except Exception as err: return_error('The provided input was not an array or CSV data:\n\n{err}') # Create a temporary store for the sub-lists return_data = [] # Iterate each set of <set_count> items while len(items) > set_count: return_data.append(items[0: (set_count)]) [items.pop(0) for x in range(set_count)] # Add the remaining Items as their own sized array return_data.append(items) # Create the final returned data array results = [] # Create an index for the set number set_number = 0 # Iterate throught the arrays and place them into a suitable format for item in return_data: results.append( { 'set': set_number, 'items': item }) set_number += 1 # Build the command results object command_results = CommandResults( outputs_prefix=output_key, outputs_key_field=['set'], outputs=results, readable_output=tableToMarkdown('Items', results, ['set', 'items']), ) # Return the command results object return_results(command_results) type: python tags: [] comment: This will split the input array into chunks of *maxitems* enabled: true args: - name: items required: true description: an array of items to be split isArray: true - name: maxitems required: true description: number of items in a chunk - name: outputkey required: true description: Parent output key scripttarget: 0 subtype: python3 pswd: "" runonce: false runas: DBotWeakRole engineinfo: {} mainengineinfo: {}   ... View more

Hi @nkazinets ,   The issue is that i do not know the subplaybook name beforehand. The name is dynamically built during execution and is stored under the key SubplaybookKey. If I try something like that - it wouldnt work: !ExportToCSV csvArray=${${SubplaybookKey}} fileName=test.csv ... View more

Hi @jfernandes1 ,   This is very promising. I encountered one issue though. I managed to dynamically set a full subplaybook name which is stored on a key. However when I try to pass the value of that key into a function that requires an array - it fails. E.g. I have set a key SubplaybookKey which after execution is dynamically set to "subplaybook-28.LogRhythm.Search.Results" When I pass the SubplaybookKey into ExportToCsv automation that requires an array - it fails as it literarily receives string "subplaybook-28.LogRhythm.Search.Results". Is there an easy way to force this value to be treated as the data behind the key?   Thanks, Antanas ... View more

Thank you for your answer @nkazinets  The reason I'm using subplaybook numbers is that I saw this commonly used by Palo Alto PS guys who inititially developed the playbooks in our environment. I understand the workaround now and will rebuild the ones in question.    Thanks again, Antanas ... View more

Hi @jfernandes1 - your updated script works perfectly fine - thanks! BTW, you still suggested to use extend-context which works after I removed the Key variable. However (I guess) it extends the normal output (seen as piped variables), and not the EntryContext, which should be an HTML table code.   ... View more

Hi @jfernandes1, for some reason extend-context does not work in this case. I specifically try extend-context=NewKey=Key Including the yml code, much appreciated for any ideas.   commonfields: id: 411b260b-c237-4b2c-8e12-3b0393af2e3e version: 2 vcShouldKeepItemLegacyProdMachine: false name: ToHTMLTable_custom script: |+ var data = args.data; var Key = args.parent; var headers = args.columns ? args.columns.split(',') : null; if(!Array.isArray(data)) { data = [data]; } var flatData = []; data.forEach(function(element) { var flattenObject = treeToFlattenObject(element); flatData.push(flattenObject); }); return {Type: entryTypes.note, Contents: tableToMarkdown(args.title, flatData, headers), ContentsFormat: formats.markdown, EntryContext: { Key : tableToHTML(args.title, flatData, headers)}}; type: javascript tags: - Utility comment: Convert an array to a nice table display. Usually, from the context. enabled: true args: - name: data required: true description: The data to display as table - expecting array of objects isArray: true - name: title description: Title for the table - name: columns description: Comma-separated list of columns to display. Accepts nested columns using dot notation. - name: parent required: true description: Context Key to store output scripttarget: 0 pswd: "" runonce: false runas: DBotWeakRole engineinfo: {} mainengineinfo: {}   ... View more

Hi @jfernandes1 , this worked like charm! I tested this with a bigger set of real life data, all appears as expected. For the record, I made some changes to be even more generic: added matchingKey2 in case the key name is not the same in both lists; added a "parent" key so I could define each time where the results would be stored in. The final code is as follows:   commonfields: id: cfc605f7-6d30-4ea0-8330-dacb34e60397 version: 10 vcShouldKeepItemLegacyProdMachine: false name: joinListWithLookup script: | # Accept the input as arguments list1 = demisto.args()['list1'] list2 = demisto.args()['list2'] # Key that should be tested for matches. Since the order is unknown keyMatch1 = demisto.args()['matchingKey1'] keyMatch2 = demisto.args()['matchingKey2'] parent = demisto.args()['parent'] # Validate the input error = 1 if isinstance(list1, list): if isinstance(list2, list): if isinstance(keyMatch1, str): if isinstance(keyMatch2, str): error = 0 if error == 1: return_error("Invalid inputs") newList = [] # Loop primary list for item in list1: # Loop secondary list for x in list2: # Check if there is a matching key between the lists if x[keyMatch2] == item[keyMatch1]: # Add new keys from secondary list to primary for key in x.keys(): # Only add if they key does not exist, prevent existing data from being overwritten if key not in item.keys(): item[key] = x[key] # Join data to new list newList.append(item) # In the last example I included a simple output. # The below example add data to the context and the warroom (A nice table) demisto.results({ 'Type' : entryTypes['note'], 'Contents': newList, 'ContentsFormat' : formats['json'], 'HumanReadable': tableToMarkdown('New Table', newList), 'ReadableContentsFormat' : formats['markdown'], 'EntryContext' : {parent : newList } }) type: python tags: [] comment: joins to context entries, where matchingKey1=matchingKey2, e.g. !joinListWithLookup list1=${data.list1} list2=${list2} matchingKey1=key1 matchingKey2=key2 parent=results enabled: true args: - name: list1 required: true description: first list, e.g. ${list1} isArray: true - name: list2 required: true description: second list, e.g. ${list2} isArray: true - name: matchingKey1 required: true description: key from 1st list to match - name: matchingKey2 required: true description: key from 2nd list to match - name: parent required: true description: new key to put joined results in scripttarget: 0 subtype: python3 pswd: "" runonce: false dockerimage: demisto/python3:3.10.4.29342 runas: DBotWeakRole engineinfo: {} mainengineinfo: {}   Thanks a lot for your help!     ... View more

Hi @jfernandes1 , thanks, your POC code actually works! I would like to make a generic case from this. You specifically use item['Hostname'] = x['Hostname'] How can I get and use this field, if it is different next time; or there are more than 1  subkeys under Hostnames? So far I came with below code, but not sure how to handle Hostname. args = demisto.args() parent = args.get('parent') key1 = args.get('key1') key2 = args.get('key2') index1 = args.get('index1') index2 = args.get('index2') data = demisto.context()[parent] newList = [] for item in data[key1]: for x in data[key2]: if x[index2] == item[index1]: item['Hostname'] = x['Hostname'] newList.append(item) results = CommandResults( outputs_prefix='Output', outputs_key_field='Result', outputs=newList ) return_results(results)     ... View more

Thanks!  I definitely will try it. I also finally found a workaround for this - i import the whole thing with with parseCSV, and then use a transformer GetFields in SetAndHandeEmpty to save the selected keys. Then i can delete the the initial one. Of course, your  suggested solution is more optimal. ... View more