How to access an entites 'IsEnriched' field from a playbook condition

Question

I’m building a playbook that runs on new alerts and enriches it’s entities. To avoid unnecessary API calls, I want to only enrich entities that have not already been enriched. Some cases may contain alerts with the same entities, it would be inefficient to run each duplicate entity through enrichment each time.

The idea is to have a condition at the start of the playbook that filters on the ‘Entity.IsEnriched’ field. If this field is False, perform enrichment. Once enrichment is complete, the playbook would then set the field to True.

I can set the field value for an entity fine using the ‘Enrichment - Enrich Entity With Field’ action. My issue is that I cannot access this field from anywhere in the playbook. Other fields such as ‘Entity.IsInternal’ are exposed, but this is not.

Why is this?

rodajrc · Accepted Answer

That’s a good optimization for enrichment blocks and playbooks!

If you want to really use the is_enriched field, you can use the Siemplify Get Case Alerts action to check the result object that defines your current alert. An example is shown below:

The is_enriched field can be found under the path .[].domain_entities[].is_enriched (for domain entities). There’s also domain relationships, hashes, urls, etc.

Then, you can type the following placeholder in a condition to check whether that field is true or false:

[Enrich All Entities with GTI.is_success]

Having this idea in mind, I built this test playbook quickly:

Simple IsEnriched Playbook for Domain Entities

The playbook uses the Siemplify - Get Case Alerts action to loop on [Get Case Alerts.JsonResult| "domain_entities.identifier"]. The condition then reads the following placeholder to check if its value is false.

[Get Case Alerts.JsonResult| "domain_entities" | filter("identifier", "=", "[Loop.Item]") | "is_enriched" | toLower()]

That placeholder uses the filter() function to check if the JSON field filter is set to [Loop.Item], which is a nested placeholder that resolves to .[].domain_entities[].identifier

That’s necessary in order to check one entity at a time. If that entity’s is_enriched field is set to false, it routes to the Not Enriched path. Otherwise it goes to the else path.

I did this quickly, it may contain bugs, but I think it may help solve your specific use case, although there may be better ways to handle this enrichment deduplication.

scuba-steve · Answer

That will work, was unaware I could access the entity fields using that action.Much appreciated!

Sign up

Login with SSO

Login to the community

Login with SSO