cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Who rated this post

L3 Networker

This is certainly possible. Firstly you would need to decide what Context key name to put them under. After you have decided, generally we use 

return_results(command_results)

where "command_results" is a CommandResults object (for which the documentation on how to use it is here

 

 

As an example (and assuming you have a scrip that has an argument input called "ips"):

 

# Get the arguments
args = demisto.args()
ips = args.get('ips')

# Check that the input is either an array or can be split
if not isinstance(ips, list):
    try:
        ips = ips.split(",")
    except Exception as err:
        return_error(f'The provided input was not an array or CSV data:\n\n{err}')

# How many IPs to break the array into
set_count = 10

# Create a temporary store for the sub-lists
return_data = []

# Iterate each set of <set_count> ips
while len(ips) > set_count:
    return_data.append(ips[0: (set_count)])
    [ips.pop(0) for x in range(set_count)]

# Add the remaining IPs as their own sized array
return_data.append(ips)

# Create the final returned data array
results = []

# Create an index for the set number
set_number = 0

# Iterate throught the arrays and place them into a suitable format
for item in return_data:
    results.append(
        {
            'set': set_number,
            'ips': item
        })
    set_number += 1

# Build the command results object
command_results = CommandResults(
    outputs_prefix='IPSets',
    outputs_key_field=['set'],
    outputs=results,
    readable_output=tableToMarkdown('IPs', results, ['set', 'ips'])
    )
    
# Return the command results object
return_results(command_results)

 

The result in the context is an array containing dictionaries. Each dictionary has a set number (to avoid duplicates) and the actual IPs.

 

I hope this helps.

 

Regards


Adam

View solution in original post

Who rated this post