Secops-SOAR - Nesting placeholders

Question

So it seems is not possible to nest placeholders in the expression builder right?

I have several fields that come with comma separated values, pretty much like field1: “value1, value2, value3”.

So I wanted to iterate over a list of items and do operations like conditions, as in “item 1 = value1”.
I created a loop and I thought in in the expression builder I could just add something like [item_list | split(“,”)] getbyindex(“[Loop.Index]”) ]

(Also adding an incremental value of -1 since loops are based 1 and positions based 0)

Either I’m missing something or I just need a new approach like just go ahead and code a new action in IDE.

JeremyLand · Answer

That may work if you take the quotes out from around the placeholder in your get by index function. But you’ll still need to handle the index offset ( `|incrementValue(“-1”)` should do the trick)

I have had success previously referencing items from the loop with this so it seems like it should work in your situation.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded