Splunk SOAR

can't add artifact field with message parameter

meshorer
Path Finder

hello all!

I am trying to add  field to an artifact with "update artifact" action (phantom app).

i am trying to add a 'message parameter' in the 'value' at the cef_json field:

for example:

{"new_field": {0}}

but unfortunately I get "key_error" and the action failed. 

how can I solve it?

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@meshorer  when using the format input or format block for JSON you need to use double { & } and encase the value in " such as the below (which I just tested):

{{"new_field": "{0}"}}

Note that you don't need to double the {&} on the {0} as it's a replacement element but the actual JSON elements will need escaping in this way, even if you had nested JSON like the below:

{{"new_field": {{"sub_field": "{0}"}}}}

-- Hope this helps! If so please mark as a solution for future SOARers. Happy SOARing! --

View solution in original post

Tags (3)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@meshorer  when using the format input or format block for JSON you need to use double { & } and encase the value in " such as the below (which I just tested):

{{"new_field": "{0}"}}

Note that you don't need to double the {&} on the {0} as it's a replacement element but the actual JSON elements will need escaping in this way, even if you had nested JSON like the below:

{{"new_field": {{"sub_field": "{0}"}}}}

-- Hope this helps! If so please mark as a solution for future SOARers. Happy SOARing! --

Tags (3)
0 Karma

meshorer
Path Finder

@phanTom thak you so much!

could you also tell me how to add two fields in the same action?

0 Karma

phanTom
SplunkTrust
SplunkTrust

@meshorer just add more keys & values to the JSON string 😁

{{"new_field1": "{0}", "new_field2": "{1}"}}

 

 

0 Karma

meshorer
Path Finder

@phanTom  yeah I got confused with the escaped "{} ".

you are the best!

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...