End-of-Life (EoL)

Filters and Transformers

playbook filter transformer mapping
In Cortex XSOAR, data is extracted and collected from various sources, such as playbook tasks, command results, and fetched incidents, which is presented in JSON format. The data can be manipulated by using filters and transformers. You can add filters and transformers in a Playbook task or when mapping an instance.
Filters
Filters enable you to extract relevant data, which you can use elsewhere in Cortex XSOAR. For example, if an incident has several files with varying file types and extensions, you can filter the files by file extension or file type, and use the filtered files in a detonation playbook. To create a filter, see create a filter.
In Cortex XSOAR version 5.5 and below, if you want to filter more than one object such as nested objects you need to either create a top level key using the Set command or use a transformer as a filter.
Transformers
Transformers enable you to take one value and transform or render it to another value. For example, converting a date in non-Unix format to Unix format. Another example is applying the
count
transformer, which renders the number of elements.
To create a transformer, see create a transformer. When you have more than one transformer, they apply in the order that they appear. You can reorder them using click-and-drag.

Recommended For You