Unable to use results of fetched events in SAR playbook downstream

Question

I have a playbook that fetches UDM events using the ‘GoogleChronicle - Execute UDM Query’ action. This action return events in the format below:

{

"events": [

{"foo": “bar”},

]

}

I need to loop over each event in the events list returned, and send an email containing the dict details. I cannot seem to consume this data in any GSO action without throwing the below error:

Message: Unable to cast object of type 'System.String' to type 'Newtonsoft.Json.Linq.JToken'.

I can use the base JSONResult from the action, but after parsing it and trying to access the nersted values, i get the above.

Any idea what could be causing this?

Thanks

dnehoda · Answer

In Google SecOps SOAR, the built-in For Each Loop and Expression Builder handle lists as delimited strings by default, which breaks nested dictionary access unless the data is pre-formatted or re-parsed.Couple ideas on how to fix thisOption 1: Send One Email Per Event (Pre-Format with TemplateEngine + Safe Delimiter)Instead of passing raw JSON objects into the For Each Loop (where commas inside the event dictionaries break the list splitter), format each event into a string first using a unique delimiter.StepAction to AddConfiguration Details1TemplateEngine - Render Template from Array• Array Input: [GoogleChronicle_Execute UDM Query_1.JsonResult | "events"]• Jinja: Foo: {{ row.foo }} (or {% for k, v in row.items() %}{{ k }}: {{ v }}
{% endfor %} for all keys)• Join: ||| (a unique delimiter that will not appear in event data)2For Each Loop (Loop Start)• Loop over: List• Items: [TemplateEngine_Render Template from Array_1.ScriptResult]• Delimiter: |||3Email - Send Email (Inside Loop)• Content / Body: Insert [Loop.item] directly (no further JSON parsing needed).Option 2: Parse [Loop.item] as a JSON Object Inside the Loop (Tools - Buffer)If downstream actions inside your loop require accessing individual JSON keys via the Expression Builder, you must convert [Loop.item] from a System.String back into a JToken using the Tools - Buffer action.StepAction to AddConfiguration Details1TemplateEngine - Render Template from Array (If events have >1 key)• Array Input: [GoogleChronicle_Execute UDM Query_1.JsonResult | "events"]• Jinja: {{ row | tojson }}• Join: ||| (prevents commas inside the JSON from splitting the object)2For Each Loop (Loop Start)• Loop over: List• Items: [TemplateEngine_Render Template from Array_1.ScriptResult]• Delimiter: |||3Tools - Buffer (Inside Loop)• JSON: [Loop.item] (converts the string into a parsed JSON object)4Email - Send Email (Inside Loop)• Content / Body: Select [Tools_Buffer_1.JsonResult | "foo"] via the Expression Builder.

Step	Action to Add	Configuration Details
1	TemplateEngine - Render Template from Array	• Array Input: `[GoogleChronicle_Execute UDM Query_1.JsonResult \| "events"]` • Jinja: `Foo: {{ row.foo }}` (or `{% for k, v in row.items() %}{{ k }}: {{ v }}<br>{% endfor %}` for all keys) • Join: `\|\|\|` (a unique delimiter that will not appear in event data)
2	For Each Loop (Loop Start)	• Loop over: `List` • Items: `[TemplateEngine_Render Template from Array_1.ScriptResult]` • Delimiter: `\|\|\|`
3	Email - Send Email (Inside Loop)	• Content / Body: Insert `[Loop.item]` directly (no further JSON parsing needed).

Step	Action to Add	Configuration Details
1	TemplateEngine - Render Template from Array (If events have >1 key)	• Array Input: `[GoogleChronicle_Execute UDM Query_1.JsonResult \| "events"]` • Jinja: `{{ row \| tojson }}` • Join: `\|\|\|` (prevents commas inside the JSON from splitting the object)
2	For Each Loop (Loop Start)	• Loop over: `List` • Items: `[TemplateEngine_Render Template from Array_1.ScriptResult]` • Delimiter: `\|\|\|`
3	Tools - Buffer (Inside Loop)	• JSON: `[Loop.item]` (converts the string into a parsed JSON object)
4	Email - Send Email (Inside Loop)	• Content / Body: Select `[Tools_Buffer_1.JsonResult \| "foo"]` via the Expression Builder.

Sign up

Login with SSO

Login to the community

Login with SSO