Skip to main content
Question

Autogenerate Entities from an Alert

  • February 20, 2026
  • 0 replies
  • 0 views

Bernaldo
Forum|alt.badge.img+1

Hi,

Using playbooks in the SOAR I’m trying to retrieve all entities from an alert in a list (preferably) or dict that indicates not only the value but also a classification of the object.

For example, if the alert has an src.ip and a dst.ip generate a dict or list like {[1.1.1.1,ip],[2.2.2.2,ip]} or similar, but taking in account that an alert can have mail addresses, hashes, all kinds of entities.

Let’s see if someone can help me.

Best regards.

Β