End-of-Life (EoL)

Create Filters and Transformers in a Playbook

filter transformer playbooks mapping
You can create filters and transformers when adding or editing a task in a playbook or when mapping an instance.
In Cortex XSOAR version 5.5 and below you cannot filter nested objects unless you use the Set command, or use a filter as a transformer.
  1. Create or edit a playbook task.
  2. In the field you want to add a filter or transformer, click and then select
    Filters and Transformers
    .
  3. In the
    Get
    field, type or select data your want to filter or transform.
  4. (
    Optional
    ) To filter the data, click
    Add filter
    .
    1. Select the data you want to filter.
    2. Select the Filter Operators.
    3. Add the value.
      For example, to filter for PDF file extensions:
      Get
      File.Name
      Filter,
      File.Type
      equals
      PDF
      .
    4. Click the tick box to save the filter.
  5. (
    Optional
    ) To apply transformers to the field, click
    Add transformer
    .
    1. Click the transformer and select the relevant transformer.
      For example, you may want to change the date format for when incidents occurred.
    2. Click the tick box to save.
  6. (
    Optional
    ) To test the filter or transformation click
    Test
    and select the investigation or add it manually.

Recommended For You