Update Record Issue "Tenant"

[esoc]

Hello Guys,

we have a problem changing the "Tenant" field.

Our idea is this, once the exchange connector fetches an email from an inbox, this opens an alert (and this is something that already happens).

Once the alert is opened, we would like it to be routed to the correct tenant.

We thought that the best way is to create a playbook where at start, he reads a condition (in this case the condition is that, if the word "x" is present in the name of the alert then start the playbook)

the next phase is that of update record, where we tell the function to update the "Tenant" field in that case.

But we constantly get an error i.e. "Error message : can only concatenate str (not \"dict\") to str"

We have also attached an image of this, can you give us support?

[swolf]

Support should be obtained by contacting Fortinet TAC.

That said, it's telling you the issue. You've got a dictionary object that you are trying to perform a concatenation on (joining two or more pieces together). You can only perform concatenation on strings. So, the quick answer is that you need to convert the dictionary to a string before you do the concatenation.

[esoc]

and how can I convert the field to string directly from the playbook?

[swolf]

Off the top of my head it would be:
{{ variableName | str }}
But you'll probably need to strip out some of the syntax from what makes it a dictionary.

Alternatively, access the value you need from the dictionary directly using the key. As long as the value at the key is a string, you wont need to worry about conversion, etc. Example of accessing a dictionary's key:

{{ dict_name[key_value] }}

[sahirrao]

You can map the tenant at the time of data ingestion while creating the alert, rather than updating the tenant field in playbook, 

[esoc]

the problem is that we have several tenants, and only one email inbox, so the only parameter that can help us understand which tenant to assign it to is the email subject field, but this field contains several words inside, we attach a screen to make the concept better understood.

This is the internal mapping of the exchange connector, there is the possibility of mapping the tenant, the problem is that as mentioned before, the only field from which we can retrieve the correct name of the tenant is the subject field, in the case of the screen it would be "Reset"

We don't understand how we can recover that value and insert different ones every time a new email arrives.

Let's also add another thing, we also tried to create a playbook that duplicated the already existing alert, setting the create new record to update only certain fields (in the new duplicate alert) but not even the tenant field

[sahirrao]

In data ingestion playbooks, modify "> Exchange > Extract and Link File Indicator" playbook and add one set variable step where you can map the tenant as per the email subject and assign that variable to Tenant field in "Create Record" step of same playbook.