SOAR Playbook Json Result multiple value expression

Hi,

The form [placeholder.JsonResult | key] is designed to loop through any arrays it finds and extract.  So the output url1,url2,url3 is expected

To build these into a HTML list of span there are a couple of ways, the best is Template Engine, I'm not the best at Jinja so I will use AI...

First replace the hardcoded string with your placeholder, and remember to wrap with "
(sorry for the image, forum wont let me paste the code)

 The ScriptResult of this Action should be:
<span...></span><span...></span><span...></span>

So put this into your Send Email body

HTH?

It looks like this will meet my needs. I’ll give it a try and get back to you soon. Thank you very much 🙏 🙂

Hi,

Thank you, I’ve successfully created the template and sent each URL along with its screenshot in a table via email. However, now I need to insert a button for each URL that triggers an action (e.g., blocking the URL on a firewall, EDR, etc.). I don’t think this is possible. Is there any way to achieve this?

Depends on where you are doing it from:

From within SecOps: you use Manual Actions in the case, find the Action to block, then pick the URLs from the dropdown

I don't think buttons in Widgets is the way to do this, because the amount of buttons is dynamic (1 or 10?)

If you are combining this with send email and 1 alert this is challenging, because this is for an unpredictable amount or URLs, of user defined input, that can happen out of sequence at any point. You could use Approval Links to do "all", "none", or "subsets" but this isn't quite what you're asking.

I would suggest either finding a workflow that the user can cause a new alert into SOAR via a webhook, or create this user an account as a collaborator (/managed user depending on your business setup) and in the email inclue a link to ".com/#/your-workdesk/requests" where they can fill out each URL into a request when they are ready.