Filters and Transformers

Use Cortex XSOAR 6.14 filters and transformers to manipulate playbook data.

In Cortex XSOAR, data is extracted and collected from various sources, such as playbook tasks, command results, and fetched incidents, and presented in JSON format. The data can be manipulated by using filters and transformers. You can add filters and transformers in a playbook task or when mapping an instance.

Filters

Creating filters enables you to extract relevant data, which you can use elsewhere in Cortex XSOAR. For example, if an incident has several files with varying file types and extensions, you can filter the files by file extension or file type, and use the filtered files in a detonation playbook.

You can filter as many objects as required. Cortex XSOAR automatically calculates the context root to which to filter. You can change the context root, as necessary.

Transformers

Creating transformers enables you to take one value and transform or render it to another value. For example, converting a date in non-Unix format to Unix format. Another example is applying the count transformer, which renders the number of elements.

When you have more than one transformer, they apply in the order that they appear. You can reorder them using click-and-drag.

Create Filters and Transformers in a Playbook

You can create filters and transformers when adding or editing a task in a playbook or when mapping an instance.

You can filter as many nested objects as required. Cortex XSOAR automatically calculates the context root to which to filter. For example, if you want to extract all Item names in EWS, Cortex XSOAR calculates that the context root is EWS.items.

playbook-ews-1.png

Warning

You can change the context data root to which to filter, but it is not recommended to select a different root, as it affects the filter results. The dropdown list displays the filter root for backward compatibility.

1. Create or edit a playbook task.
2. In the field you want to add a filter or transformer to, click and then select Filters and Transformers.
3. In the Get field, type or select data you want to filter or transform. For example, EWS.Items.Name.
4. (Optional) To filter the data, do the following.

   1. In the Filter section, click Add filter.

      When adding a filter, Cortex XSOAR automatically populates the context root to which to filter.
   2. Select the data you want to filter.
   3. Select the Filter Operators.
   4. Add the value.
   5. Click the checkbox to save the filter.

   For examples, see Create a Filter Example, Create a Filter (Advanced) Example, and Work with JSON Lists.
5. (Optional) To apply transformers to the field, click Add transformer.

   1. Click the transformer and select the relevant transformer.

      For example, you may want to change the date format for when incidents occurred.
   2. Select the Transformers Operators.
   3. Click the checkbox to save.
6. (Optional) To test the filter or transformation click Test and select the investigation or add it manually.