Create a Filter (Advanced) Example - Administrator Guide - 6.8 - Cortex XSOAR - Cortex

Create a Filter (Advanced) Example - Administrator Guide - 6.8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product

Cortex XSOAR

Version

6.8

Creation date

2022-09-28

Last date published

2024-04-08

End_of_Life

EoL

Category

Administrator Guide

Abstract

Advanced example of how to create a filter in Cortex XSOAR. filters transformers objects playbooks

In this example, we want to see the LastResolved time only from the demisto.com host name.

This is part of the data where we want to filter:

From the Filters & transformers window, in the Get field, type IP.AutoFocus.Resolutions.LastResolve.
In the Filter section, click Add filter.
Cortex XSOAR calculates automatically that the context root to filter is IP.AutoFocus.Resolutions.
In the left-hand side, add Hostname to the filter.
Select Equals (String) → Ends with
In the right-hand side add demisto.com.
Click the tick box to save.
Click Test.