IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

How to access value of any cell in a data table using playbook or workflow

  • 1.  How to access value of any cell in a data table using playbook or workflow

    Posted Wed January 24, 2024 01:57 AM

    Hello team,

    We are working with data tables in resilient. The requirement is to access the data in the datatable "Sentinel Incident Entities" and to access a particular cell in the row that is under the column "Entity Properties". In the above example, we need to access the particular value "additional data : " in the cell( second row fourth column).



    ------------------------------
    Akash Jaiswal
    ------------------------------


  • 2.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Wed January 24, 2024 08:03 AM

    Hi Akash,

    I have reached out for support to our team ....someone should be in contact shortly .

    John



    ------------------------------
    John Quirke
    ------------------------------



  • 3.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Wed January 24, 2024 08:36 AM

    Hi,

    I am not a SOAR expert but to my knowledge, the only way I know of accessing the rows of a data table would be to install and use the Datatable Utilities (IBM SOAR Data Table Helper Functions) from the App Exchange.

    Then you can use the functions provided by it like: Get Row, Get Rows,  Get All Data Table Rows

    HTH



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 4.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Wed January 24, 2024 08:40 AM

    Hi Akash -

    Yes, you can access the full row of a data table when you create a Playbook or Workflow that is activate on that type of data table.

    I'll take the Playbook example to show you what this looks like:

    • Create a new playbook (manual or automatic, both will work for this)
    • Select object type "Data table"
    • You'll see a new drop down appear below the object type, asking for the specific Data table you wish to activate this playbook on
    • Select the data table from the drop down
    • Now when you write a script within this playbook, you'll have access to the row object which has all of the row's cell values
    • You can access those values, you can modify them, etc...
    • More documentation on row operations can be found here: https://www.ibm.com/docs/en/sqsp/51?topic=scripts-row-operations

    I hope that helps!

    If you need to do more complicated operations within a data table, I recommend using the "IBM SOAR Data Table Helper Functions" app on App Exchange which provides extended data table functionality in the form of functions that can be used in any playbook or workflow.



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 5.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Fri January 26, 2024 12:44 PM

    Thanks, Bleckel, 

    now I am able to get the value of one particular row but in the table, for entity column we have type account in two rows.

    now when I run the script, Im only able to get the value of only one row and the values im storing in a different field of text area type.

    my goal is to get all the value of type account

    for ex

    if entity type=="Account"

     then i should get the value of entity properties from all the rows having type account in a single field 

      



    ------------------------------
    Akash Jaiswal
    ------------------------------



  • 6.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Fri January 26, 2024 12:54 PM

    Ah ok. Then I suggest you design a Incident-level playbook which makes use of the "Get all data table rows" function from the "IBM SOAR Data Table Helper Functions" app on App Exchange.

    The results of this function give you a list of rows which you can then iterate over and check the cell value for each.

    Example script to process the results from that function call:

    for row in playbook.functions.results.<output_name>.content.rows:
        cells = row.get("cells")
        for cell in cells:
            # do whatever you want here with the cell

    I hope this helps!

    Bo



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 7.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Sat January 27, 2024 08:44 AM

    getting the following error for this script

    for row in playbook.functions.results.rowdata.content.rows:
        cells = row.get("cells")
        incident.properties.test_datatable=cells



    ------------------------------
    Akash Jaiswal
    ------------------------------



  • 8.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Mon January 29, 2024 08:30 AM

    Ok - well the example I gave was to use in a script that runs after the function is used, and specifically I assumed you were using a playbook.

    You'll have to decide how you'll use the function and then process the results. It appears that you're running this as a script test? You won't be able to do that exactly... You'll have to plug this in as a script after the function and play around with it until it works.

    If you need help with a specific instance of a playbook and you're willing to share, I'd be happy to take a look at it as a whole and give feedback.

    Bo



    ------------------------------
    Bo Bleckel
    ------------------------------



  • 9.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Mon January 29, 2024 08:55 AM
    Edited by Akash Jaiswal Mon January 29, 2024 09:50 AM
    Hi Bo,I have added the Playbook Screenshot as well as the result I'm getting when I run the playbook manually on a particular incident
    can you help me to understand why I'm  getting this error or anything  I'm doing  wrong



    ------------------------------
    Akash Jaiswal
    ------------------------------



  • 10.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Mon January 29, 2024 10:12 AM

    Hi Akash - may I recommend two things:

    • Set the inputs for incident id from the hard coded incident ID to incident.id
    • Make sure that you use the output name of the function correctly in the script that processes the results. In this case, change playbook.functions.results.rowdata to playbook.functions.results.changerowdata since that's the name you've given the function results


    ------------------------------
    Bo Bleckel
    ------------------------------



  • 11.  RE: How to access value of any cell in a data table using playbook or workflow

    Posted Tue January 30, 2024 08:00 AM

    Hi Bo,

    Thanks for the correction, now Im able to get the values i want, thanks for the help, Really Appreciate it.

    incident.properties.datatable_final_result=""
    str =""
    for r in playbook.functions.results.rowdata.content.rows:
       cells=r.get("cells")
       str=str+cells['entity_properties']['value']

    incident.properties.datatable_final_result=str  

    Thanks and Reagrds
    Akash



    ------------------------------
    Akash Jaiswal
    ------------------------------