this is a good start, a lot of doc
-------------------------------------------
Original Message:
Sent: Sep 29, 2020 06:01 PM
From: David Wang
Subject: Identifying @ID of indicator attached to Alert record.
Hi Abhishek,
Where can I find or learn about what variables and attributes the FortiSoar have. Thanks so much.
Original Message:
Sent: Aug 07, 2020 03:19 PM
From: Abhishek Narula
Subject: Identifying @ID of indicator attached to Alert record.
Sean, the following should work (swapped single quotes with double quotes in json_query. Also see the attached Playbook
{{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query('[]."@id"') }}------------------------------
Abhishek Narula
CTO, SOAR Division | VP Product Engineering
Original Message:
Sent: Aug 07, 2020 02:31 PM
From: Sean Coupland
Subject: Identifying @ID of indicator attached to Alert record.
Whats the correct method for pulling the "@ID" value of the indicators that are attached to the record? Im trying to assign it to a variable using the syntax:
{{ (((vars.input.records[0]['@id'] + "?$relationships=true") | fromIRI).indicators)|json_query("[].'@id'") }}
The use case is so I can then do an in if statement against the type and the reputation of the indicator, to return the value (which will be the URL) of only URL indicators that have malicious reputations.
