Observed Errors in FortiSOAR Create Incident Playbook

[Arrow7]

Hello Team,

While configuring Azure Sentinel 1.1.0 data ingestion for FortiSOAR, I encountered an error upon clicking "ingest now."

Error : '{{arrow.get(fsr_loop_item.eventDateTime).to(\"America/Los_Angeles\").format(\"YYYY-MM-DD HH:MM:SS\")}}' threw an error: 'Cannot parse single argument of type <class 'jinja2.runtime.ChainableUndefined'>.'.

Playbook Name : AzureSentinel > Ingest

Thanks,

Arrow

#fortisoar 

[ShubMora]

 I can see there are some changes made in standard Data Ingestion playbooks. Can you please let us know what changes you have made, this will help us to debug the issue.

[JimH]

I’ve seen this when trying to update a Date/Time field.  From the documentation it requires epoch time.

Try the following:

{{arrow.get (fsr_loop_item.eventDateTime).int_timestamp}}