How to get subkey if the parent key is dynamic in the expression builder

Question

Hi everyoneI'm getting a JSON in a playbook action. I want to reuse that json in another action of my playbook.I'm trying to get the value of a subkey “category” in a nested json like this{   “a”:{“category”:1},   “b”: {“category”:3}}I haven’t found a way to extract “category” values ignoring the parent keys.Is there a way to do it?I’m expecting to get a result like [1,3]Parent keys are dynamic and I can't predict or list every possibilitiesDo you know how we can do this? Many thanks by advance :)

cmorris · Accepted Answer

You can do this with the Run JSONPath Query action - https://docs.cloud.google.com/chronicle/docs/soar/marketplace-and-integrations/power-ups/functions#run-jsonpath-query

Example:

Add your JSON result placeholder to the Editor section and then write the JSONPath Expression. For the example here, I used a VT action and wanted to pull links from the VT action’s analysis. Rather than specifying the full path, I provided an expression to the field of interest.

Result:

janguise · Answer

Many thanks! It's exactly what I was looking for 😊, and it worked perfectly.

Sign up

Login with SSO

Login to the community

Login with SSO