Skip to main content


Is there an easy way to use the table-formatted output that some actions provide? I thought you'd be able to add it to an insight, but I think I'm missing something? They're currently buried in the case wall.


If I understand you correctly, I think you are referring to some actions that return a pretty-looking table as well as a json. And some of these actions place data only in the table and not in the JSON.





Short answer is no, not an easy way because that data is not exposed to something your playbook can use.





Is it possible?


Yes!


Best idea would be to clone the action, review the parameters that are missing from the json, and add them!



At least, that's been my experience



That makes sense. Yeah, I just saw some nicely built tables and it felt silly to rebuild them from the json just to be able to display them in an insight or somewhere else.



Completely agree! There was one action, I think urlscan, that returned the URL for the screenshots in the table only. Like I totally want that elsewhere too! And so, a clone and edit later~


Reply