Problem with Indicators Enrichment on FortiSOAR

[rrighi]

Hi team,

I´ve installed FortiSOAR, configured some connectors (icluding VirusTotal and IPQuality), created soem playbooks and everyhting seemed working well. Then, I installed the Phsihing Solution Pack and run it. When I opened the indicator "http://demo.gumblar.cn/", I realized the system was to slow to enrich the indicator. So, I opened the Playbook execution viewer and realized the playbook "Enrich Indicators (Type All)" stopped on "Compute Reputation Data" with a Jinja error code (CD-WF-8) - attached.

After that, I went to the Indicators module and tried to create a manual indicator for IP. I´ve created the new indicator, but again realized the Enrichment has stopped int he same playbook step (and same playbook). 

I talked to a colleague of mine who suggested me to change the Global Variable "Demo_mode" to false. However, I realized this variable was still as false.

Would like to ask your help for solving this issue. The interesting thing that other parts of FortiSOAR are working well (for example, I am ingesting FortiSIEM alerts into SOAR, and this connector seems OK. I´ve also create small playbooks for presenting to customers and this part is also OK. the problem is  in that specific playbook for enrichment)

Thank you in advance for any suggestion.

Best Regards,

Rafael Righi

  

[malayamanas_FTNT · Accepted solution]

{{item.source_data}} This is stored as STRING in DB. Use "toDict" filter to convert that to dictionary in sd.update(item.source_data|toDict)