When tested with Cisco Talos domain reputation check, it errors out as it returns the whole list: domain = "['domain1, 'domain2']" ['domain1, 'domain2'] is not a valid domain name. Perhaps you meant to use the 'ip reputation' or 'url reputation' action instead of 'domain reputation'?
... View more
Thanks @phanTom . Yeah, I tried with format block .* output and looking at the format block result seems like it doesn't parse it through properly: formatted data: ['domain1','domain2'] formatted data.*: 0: ['domain1','domain2']
... View more
Successful when using finding:consolidated_findings.example.0 or finding:consolidated_findings.example.1 but not when using finding:consolidated_findings.example.* as input parameter. Using only finding:consolidated_findings.example returns ['domain1', 'domain2'] as parameter. Is there a way to send multiple values as parameter without having to create another playbook just to loop through nth?
... View more