Create a Filter Example - Playbook Design Guide - 6.x - Cortex XSOAR - Cortex

Create a Filter Example - Playbook Design Guide - 6.x - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Playbook Design Guide

Product

Cortex XSOAR

Version

6.x

Creation date

2023-01-19

Last date published

2023-12-19

Category

Playbook Design Guide

In this example, we want to filter all EWS Item names that have the extension exe.

From the Filters & transformers window, in the Get field, type EWS.Items.Name to extract all Item names in EWS.
Cortex XSOAR calculates that the context root to filter is EWS.Items.
In the Filter section, click Add filter.
In the left-hand side, add Extension to the filter.
Select Equals (String) → ignore case.
In the right-hand side, add exe.
Click the checkbox to save the filter.
Click Test.
You can see we have filtered all item names that have the extension exe.