Create a Filter (Advanced) Example - Playbook Design Guide - 6.x - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Playbook Design Guide

Product
Cortex XSOAR
Version
6.x
Creation date
2023-01-19
Last date published
2023-12-19
Category
Playbook Design Guide

In this example, we want to see the LastResolved time only from the demisto.com host name.

This is part of the data where we want to filter:

{
    "IP": [
       {
        "Address": "192.168.10.96",
        "AutoFocus": {
            "Resolutions": [
                {
                    "Hostname": "79463wwfqq,dattolocal.net",
                    "LastResolved": "2022-08-02 04:01:02"
                },
                {
                    "Hostname": "demisto.com",
                    "LastResolved": "2022-09-10 09:47:17"
                },
                {
                    "Hostname": "securesense.call4pchelp.com",
                    "LastResolved": "2022-04-22 11:49:06"
                }
            ]
        }
       },
       {
        "Address":"192.168.10.96",
        "AutoFocus": {
            "Resolutions":[
                {
                    "Hostname":"79463wwfqq,dattolocal.net",
                    "LastResolved":"2022-08-02 04:01:02"
                },
                {
                    "Hostname":"demisto.com",
                    "LastResolved":"2022-09-10 09:47:17"
                },
                {
                    "Hostname":"securesense.call4pchelp.com",
                    "LastResolved":"2022-04-22 11:49:06"
                }
            ]
        }
       }
    ]
}
  1. From the Filters & transformers window, in the Get field, type IP.AutoFocus.Resolutions.LastResolve.

    playbook-filter-auto.png
  2. In the Filter section, click Add filter.

    Cortex XSOAR automatically calculates that the context root to filter is IP.AutoFocus.Resolutions.

    playbook-filter-autores.png
  3. In the left-hand side, add Hostname to the filter.

  4. Select Equals (String)Ends with

  5. In the right-hand side add demisto.com.

  6. Click the checkbox to save.

    playbook-filter-autofilter.png
  7. Click Test.

    playbook-filter-autotest.png