Filter and transform Cortex XSIAM playbook data

Filter and transform Cortex XSIAM playbook data, JSON context, and task mappings for downstream automation tasks.

Use Cortex XSIAM filters and transformers to manipulate playbook data. Add them to playbook tasks or instance mappings for downstream security automation.

Cortex XSIAM collects data from playbook tasks, command results, and fetched issues. It presents this playbook context in JSON format. Filters and transformers extract, modify, and format this data.

Filter Cortex XSIAM playbook data

Filters extract relevant data for use elsewhere in Cortex XSIAM playbooks. For example, an issue can contain files with different types and extensions. Filter these files by extension or type, then use them in a detonation playbook.

You can filter as many objects as needed. Cortex XSIAM automatically calculates the context root for each filter. Change it only when necessary.

Caution: Changing the context data root can affect filter results. The drop-down list displays the filter root for backward compatibility.

Transform Cortex XSIAM playbook data

Transformers modify or format playbook data for further processing or presentation. For example, convert a non-Unix date to Unix format. The count transformer returns the number of elements.

When you add multiple transformers, Cortex XSIAM applies them in displayed order. Drag and drop transformers to reorder them.

Add filters and transformers to Cortex XSIAM playbook tasks

1. Create or edit a playbook task.

2. In the relevant field, such as inputs or outputs, click the curly brackets.

3. Select Filters and Transformers.

4. In Get, enter or select the data to filter or transform. For example, EWS.Items.Name.

5. Optional: Add a filter.

   1. In Filter, click Add filter. The context root is populated automatically.

   2. Select the data to filter.

   3. Select the filter operators.

   4. Enter a value.

   5. Select the checkbox to save the filter.

6. Optional: Add a transformer.

   1. Click Add transformer.

   2. Select the transformer. The default is To upper case(String).

   3. Select the transformer operators.

   4. Select the checkbox to save.

7. Optional: Click Test to test the filter or transformation. Select an investigation or add one manually.

Example: Filter items with an EXE extension

In this example, we want to filter all EWS Item names that have the extension exe.

1. From the Filters & transformers window, in the Get field, type EWS.Items.Name to extract all Item names in EWS.

   The context root to filter is EWS,Items.

   

2. In the Filter section, click Add filter.

3. In the left-hand side, add Extension to the filter.

4. Select Equals (String) → ignore case.

5. In the right-hand side add exe.

   

6. Click the tick box to save the filter.

7. Click Test.

   You should see Item names are filtered with the extension exe.

Example (advanced): Filter hostname for the last resolved time

This example returns the LastResolved time for the demisto.com hostname.

Use the following data:

{
  "IP": [
    {
      "Address": "192.168.10.96",
      "AutoFocus": {
        "Resolutions": [
          {
            "Hostname": "79463wwfqq,dattolocal.net",
            "LastResolved": "2022-08-02 04:01:02"
          },
          {
            "Hostname": "demisto.com",
            "LastResolved": "2022-09-10 09:47:17"
          },
          {
            "Hostname": "securesense.call4pchelp.com",
            "LastResolved": "2022-04-22 11:49:06"
          }
        ]
      }
    },
    {
      "Address": "192.168.10.96",
      "AutoFocus": {
        "Resolutions": [
          {
            "Hostname": "79463wwfqq,dattolocal.net",
            "LastResolved": "2022-08-02 04:01:02"
          },
          {
            "Hostname": "demisto.com",
            "LastResolved": "2022-09-10 09:47:17"
          },
          {
            "Hostname": "securesense.call4pchelp.com",
            "LastResolved": "2022-04-22 11:49:06"
          }
        ]
      }
    }
  ]
}

1. From the Filters & transformers window, in the Get field, type IP.AutoFocus.Resolutions.LastResolve.
2. In the Filter section, click Add filter.

   Cortex XSIAM automatically calculates that the context root to filter is IP.AutoFocus.Resolutions.
3. In the left-hand side, add Hostname to the filter.

4. Select Equals (String) → Ends with.

5. In the right-hand side, add demisto.com.

6. Click the checkbox to save.
7. Click Test.