Transformer considerations, categories, and built-in transformers - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-10-10
Category
Administrator Guide
Abstract

Use transformers in playbook tasks according to the following considerations.

You can use built-in transformers to define your transformer, they are grouped by category. Before defining a transformer, consider the following.

Transformer considerations
  • Transformers try to cast the transformed value (and arguments) to the necessary type. Tasks will fail if casting has failed, for example {“some”: “object”} To upper case => Error.

  • Some transformers are applied on each item of the result. For example, a, b, c To upper case => A, B, C.

  • Some transformers operate on the entire list. For example, a, b, c count => 3.

  • Some custom transformers are implemented as scripts with the transformer tag. You can find examples in the playbook automation task description.

Transformer categories and built-in transformers

When adding a transformer, clicking the default To upper case (String) field opens a search window showing the available built-in transformers. They are defined by category as follows.

Transformer category

Description

Built-in transformers

General

Generic transformers

String

String transformers

Note

To make regex case non-sensitive, use the (?i) prefix (for example (?i)yourRegexText.

Number

Number transformers

Date

Date transformers