Skip to main content
SeanCoupland
Staff
SeanCoupland
Staff
August 7, 2020
Question

Identifying @ID of indicator attached to Alert record.

  • August 7, 2020
  • 1 reply
  • 1426 views
Whats the correct method for pulling the "@ID" value of the indicators that are attached to the record? Im trying to assign it to a variable using the syntax:
{{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query("[].'@id'") }}
 
The use case is so I can then do an in if statement against the type and the reputation of the indicator, to return the value (which will be the URL) of only URL indicators that have malicious reputations.

    1 reply

    A
    Anonymous_User
    Contributor
    August 7, 2020
    Sean,  ​the following should work (swapped single quotes with double quotes in json_query. Also see the attached Playbook

    {{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query('[]."@id"') }}

    ------------------------------
    Abhishek Narula
    CTO, SOAR Division | VP Product Engineering
    ------------------------------
    -------------------------------------------
    Original Message:
    Sent: Aug 07, 2020 02:31 PM
    From: Sean Coupland
    Subject: Identifying @ID of indicator attached to Alert record.

    Whats the correct method for pulling the "@ID" value of the indicators that are attached to the record? Im trying to assign it to a variable using the syntax:
    {{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query("[].'@id'") }}
     
    The use case is so I can then do an in if statement against the type and the reputation of the indicator, to return the value (which will be the URL) of only URL indicators that have malicious reputations.
    David_Wang
    Staff
    David_Wang
    Staff
    September 30, 2020
    Hi Abhishek,

    Where can I find or learn about what variables and attributes the FortiSoar have.  Thanks so much.-------------------------------------------
    Original Message:
    Sent: Aug 07, 2020 03:19 PM
    From: Abhishek Narula
    Subject: Identifying @ID of indicator attached to Alert record.

    Sean,  ​the following should work (swapped single quotes with double quotes in json_query. Also see the attached Playbook

    {{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query('[]."@id"') }}

    ------------------------------
    Abhishek Narula
    CTO, SOAR Division | VP Product Engineering
    ------------------------------

    Original Message:
    Sent: Aug 07, 2020 02:31 PM
    From: Sean Coupland
    Subject: Identifying @ID of indicator attached to Alert record.

    Whats the correct method for pulling the "@ID" value of the indicators that are attached to the record? Im trying to assign it to a variable using the syntax:
    {{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query("[].'@id'") }}
     
    The use case is so I can then do an in if statement against the type and the reputation of the indicator, to return the value (which will be the URL) of only URL indicators that have malicious reputations.
    Mahdi1
    Staff
    Mahdi1
    Staff
    September 30, 2020
    this is a good start, a lot of doc ​-------------------------------------------
    Original Message:
    Sent: Sep 29, 2020 06:01 PM
    From: David Wang
    Subject: Identifying @ID of indicator attached to Alert record.

    Hi Abhishek,

    Where can I find or learn about what variables and attributes the FortiSoar have.  Thanks so much.
    Original Message:
    Sent: Aug 07, 2020 03:19 PM
    From: Abhishek Narula
    Subject: Identifying @ID of indicator attached to Alert record.

    Sean,  ​the following should work (swapped single quotes with double quotes in json_query. Also see the attached Playbook

    {{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query('[]."@id"') }}

    ------------------------------
    Abhishek Narula
    CTO, SOAR Division | VP Product Engineering

    Original Message:
    Sent: Aug 07, 2020 02:31 PM
    From: Sean Coupland
    Subject: Identifying @ID of indicator attached to Alert record.

    Whats the correct method for pulling the "@ID" value of the indicators that are attached to the record? Im trying to assign it to a variable using the syntax:
    {{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query("[].'@id'") }}
     
    The use case is so I can then do an in if statement against the type and the reputation of the indicator, to return the value (which will be the URL) of only URL indicators that have malicious reputations.
    Terms & ConditionsAccessibility statement