Create custom filter and transformer operators - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Select Incident Response → Automation → Scripts → New Automation.

Type a meaningful name for the script, and click Save.

To create a filter operator script, do the following:

1. In the Tags field, add the filter tag.

   If you want a custom transformer that operates on an entire array rather than on each individual item, you need to add the entirelist tag.

2. In the Arguments section, add the following arguments:

   Argument	Description
   left	Mark as mandatory. This argument defines the left-side value of the transformer operation. In this example, this is the value being checked if it falls within the range specified in the right-side value.
   right	Mark as mandatory. This argument defines the right-side value of the transformer operation. In this example, this is the range to check if the left-side value is in.

3. Add the script syntax and save.

To create a transformer operator script do the following:

1. In the Tags field, add the transformer tag.

2. In the Arguments section, add the following arguments:

   Argument	Description
   value	Mark as mandatory. The value to transform. In this example, this is the UNIX epoch timestamp to convert to ISO format.

3. Add the script syntax and save.

Go to the filters and transformers window and select the operator.