Skip to main content

Get Insights \\ Detailed table from JSON results

  • February 29, 2024
  • 1 reply
  • 22 views

ORBR
Forum|alt.badge.img+6

Hey,

I`m struggling with some issues when trying to present insight on the case\\ alert page after enrichment actions, for example, QRadar AQL search or AAD user enrichment.

I tried using the "Insights_Create Entity Insight From JSON" action but no luck. 

I would appreciate it if someone could please share a tutorial.

1 reply

SOAR_Engineer
Forum|alt.badge.img+2

When it came to presenting insights, I installed TemplateEngine (Jinja) from the marketplace's PowerUps and passed my JSON to "TemplateEngine - Render Template", then wrote the query I needed to extract specific JSON and format it, then I passed it to "Add General Insight" rather than Entity Insight. 

You can get pretty complex with what you do with Jinja (URL removed by Staff)