Create a Filter (Advanced) Example - Administrator Guide - EoL - 6.5 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
6.5
Creation date
2022-09-28
Last date published
2024-07-16
Category
Administrator Guide
End of Life > EoL
Abstract

Advanced example of how to create a filter in Cortex XSOAR.

In this example, we want to see the LastResolved time only from the demisto.com host name.

This is part of the data where we want to filter:

playbook-filter-autodata.png

  1. From the Filters & transformers window, in the Get field, type IP.AutoFocus.Resolutions.LastResolve.

    playbook-filter-auto.png

  2. In the Filter section, click Add filter.

    Cortex XSOAR calculates automatically that the context root to filter is IP.AutoFocus.Resolutions.

    playbook-filter-autores.png

  3. In the left-hand side, add Hostname to the filter.

  4. Select Equals (String) → Ends with

  5. In the right-hand side add demisto.com.

  6. Click the tick box to save.

    playbook-filter-autofilter.png

  7. Click Test.

    playbook-filter-autotest.png