Extend Context in a Playbook Task
playbooks
You can extend context either in a playbook
task, or directly from the command line. Whichever method you use,
Cortex XSOAR recommends that you first run your command with the
raw-response=true
flag.
This will help you identify the information that you want to add
to your extended data.- Navigate toAdvancedtab of the relevant playbook task.
- In theExtend Contextfield, enter the name of the field in which you want the information to appear and the value you want to return. For example, using the ad-get-user command, you could enter user=attributes.displayname to place the user's name in the user key.The following image shows the result of the !IPReuptation ip=20.8.1.5 raw-response=true command.
To include more than one field, separate the fields with a double colon. For example:user=attributes.displayName::manager=attributes.manager - To output only the values for Extend context and ignore the standard output for the command, select theIgnore Outputscheckbox.While this will improve performance, only the values that you request in theExtend Contextfield will be returned. In addition, you cannot use Field Mapping as there is no output to which to map the fields.
