Splunk SOAR

can't add artifact field with message parameter

meshorer
Path Finder

hello all!

I am trying to add  field to an artifact with "update artifact" action (phantom app).

i am trying to add a 'message parameter' in the 'value' at the cef_json field:

for example:

{"new_field": {0}}

but unfortunately I get "key_error" and the action failed. 

how can I solve it?

Labels (1)
0 Karma
1 Solution

phanTom
SplunkTrust
SplunkTrust

@meshorer  when using the format input or format block for JSON you need to use double { & } and encase the value in " such as the below (which I just tested):

{{"new_field": "{0}"}}

Note that you don't need to double the {&} on the {0} as it's a replacement element but the actual JSON elements will need escaping in this way, even if you had nested JSON like the below:

{{"new_field": {{"sub_field": "{0}"}}}}

-- Hope this helps! If so please mark as a solution for future SOARers. Happy SOARing! --

View solution in original post

Tags (3)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@meshorer  when using the format input or format block for JSON you need to use double { & } and encase the value in " such as the below (which I just tested):

{{"new_field": "{0}"}}

Note that you don't need to double the {&} on the {0} as it's a replacement element but the actual JSON elements will need escaping in this way, even if you had nested JSON like the below:

{{"new_field": {{"sub_field": "{0}"}}}}

-- Hope this helps! If so please mark as a solution for future SOARers. Happy SOARing! --

Tags (3)
0 Karma

meshorer
Path Finder

@phanTom thak you so much!

could you also tell me how to add two fields in the same action?

0 Karma

phanTom
SplunkTrust
SplunkTrust

@meshorer just add more keys & values to the JSON string 😁

{{"new_field1": "{0}", "new_field2": "{1}"}}

 

 

0 Karma

meshorer
Path Finder

@phanTom  yeah I got confused with the escaped "{} ".

you are the best!

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...