Transform a List into an Array - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide
Product
Cortex XSIAM
Creation date
2024-02-26
Last date published
2024-04-18
Category
Administrator Guide
Abstract

Create a transformer to split a list into an array when adding or editing a task in a playbook or when mapping an instance in Cortex XSIAM.

You can create a transformer to split a list into an array when adding or editing a task in a playbook or when mapping an instance.

  1. Go to Incident Response → Automation → Playbooks and create or edit a playbook

  2. Create a new task.

  3. In the Choose automation field, select the Set automation.

  4. In the Key field, enter the key name.

  5. For the value field, click {}

  6. Add a Transformer.

    1. Click Filters And Transformers.

    2. In the Get field, click {}.

    3. Expand the Lists node and select the list you want to transform.

    4. In Apply transformers on the field section, click Add transformer.

    5. Search for and select Split.

    6. (Optional) In the delimiter field, type the delimiter used to separate the items in the string (default is ",").

    7. Save the transformer.

  7. Save the task and playbook.

For a practical example of using a transformer in a list, see Apply Transformers to Extracted Data.