Is there a way to use multivalue fields in SOAR?

[staylor]

Is there a way to use multivalue fields in SOAR? I have not been able to find a good article on how to do this.

We have a few sets of logs that use multivalue fields. By default the SOAR export app will create individual artifacts with only 1 value in a field if the event has multiple values in a field. I know you can turn on the option in the SOAR export app to send all values as a mutivalue field to SOAR but the issue is when the actions inside of a playbook sees the data in a multivalue field they usually fail. 

Here is an example of how an Artifact looks when I send an event as a multi value field to SOAR.

md5_hash: ["55df197458234c1b48fed262e1ed2ed9","55df1974e1b8698765fed262e1ed2ed9"]
sha1_hash: ["b50e38123456ee77ab562816ab0b81b2ab7e3002","b50e3817d416ee77ab562816ab0b81b2ab7e3002"]
sha256_hash:["b8807c0df1ad23c85e42104efbb96bd61d5fba97b7e09a9e73f5e1a48db1e27e","b8807c0df1ad23c81234504efbb96bd61d5fba97b7e09a9e73f5e1a48db1e27e"]
domains: ["some1.domain1.com","some.domain.com"]
urls:["https://domain.com/uri/uri/picture.png ","https://some1.domain1.com/uri/uri/uri/something.gif ","https://some2.domain2.com/uri/uri/uri/something.gif ","https://some3.domain3.com/uri/uri/uri/something.gif.gif "]

Here is an example Error if I were to try and get the IPs of the domains field

Error Code: Error code unavailable. Error Message: None of DNS query names exist: ['some1.domain1.com',\032'some.domain.com']., ['some1.domain1.com',\032'some.domain.com'].localdomain.

type = A
domain = ['some1.domain1.com','some.domain.com']

I believe the playbook is seeing the data in the field as a single set of data and not a list so it is literally querying the A records for "['some1.domain1.com',\032'some.domain.com']" and not "some1.domain1.com" and "some.domain.com"

How can I split these multi value fields up so that the playbook runs them as a for loop and outputs the results as one block of data 

[mustapha_arakji]

If you're using the Splunk App for SOAR Export there's an option to create one artifact for each value in the field.

https://docs.splunk.com/Documentation/SOARExport/latest/UserGuide/Multivaluefields

[kelbys]

Splunk Core and Splunk SOAR both have concepts of multivalue fields but treat them differently. Splunk SOAR expects the multivalue fields to be split out into individual artifacts. It would not be unusual to have 100's of artifacts in a single container, each artifact being relatively small. We also have the artifact labeling system to help differentiate artifacts. My recommendation would be to embrace the option of sending over multivalue fields as individual artifacts.

If there is no mechanism to split the multivalue fields before ingestion, then you can use a preprocess playbook to grab the multivalue field using a utility like "list_demux" and split the output, and then create individual artifacts using the "artifact_create" utility. This will make it easier for all future playbooks to grab the artifact values from that container. 

You could use "list_demux" to split a mulltivalue field without creating new artifacts, but then you would need to use that utility in every playbook and that would not be ideal.

I hope that helps! Let me know if need additional clarification.

[rouma]

Bump

I'm on the same boat. Sending some data from Splunk and the field is multivalue but SOAR doesn't like that. In my case it's for devices:

ie ["2a1dfcf0a7b64610a0a01acd013ffef4","31dfe3220c144379b753dafbaa2f789b"]

Message: "Error occurred while validating given input parameters. Error : Error from server. Error details: 400 - Invalid filter expression supplied"