Create a Filter (Advanced) Example - Administrator Guide - 6.10 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.10
Creation date
2022-10-13
Last date published
2023-12-06
Category
Administrator Guide

In this example, we want to see the LastResolved time only from the demisto.com host name.

This is part of the data where we want to filter:

{
    "IP": [
       {
        "Address": "192.168.10.96",
        "AutoFocus": {
            "Resolutions": [
                {
                    "Hostname": "79463wwfqq,dattolocal.net",
                    "LastResolved": "2022-08-02 04:01:02"
                },
                {
                    "Hostname": "demisto.com",
                    "LastResolved": "2022-09-10 09:47:17"
                },
                {
                    "Hostname": "securesense.call4pchelp.com",
                    "LastResolved": "2022-04-22 11:49:06"
                }
            ]
        }
       },
       {
        "Address":"192.168.10.96",
        "AutoFocus": {
            "Resolutions":[
                {
                    "Hostname":"79463wwfqq,dattolocal.net",
                    "LastResolved":"2022-08-02 04:01:02"
                },
                {
                    "Hostname":"demisto.com",
                    "LastResolved":"2022-09-10 09:47:17"
                },
                {
                    "Hostname":"securesense.call4pchelp.com",
                    "LastResolved":"2022-04-22 11:49:06"
                }
            ]
        }
       }
    ]
}
  1. From the Filters & transformers window, in the Get field, type IP.AutoFocus.Resolutions.LastResolve.

    playbook-filter-auto.png
  2. In the Filter section, click Add filter.

    Cortex XSOAR automatically calculates that the context root to filter is IP.AutoFocus.Resolutions.

    playbook-filter-autores.png
  3. In the left-hand side, add Hostname to the filter.

  4. Select Equals (String) → Ends with

  5. In the right-hand side add demisto.com.

  6. Click the checkbox to save.

    playbook-filter-autofilter.png
  7. Click Test.

    playbook-filter-autotest.png