When working with function parameters in Resilient (from pre-processors), I have had several instances of needing to pass data types that are (seemingly not supported) by Resilient, specifically tuples. Generally, I have settled on setting the field type to text (string) and then using various string manipulation methodologies in the function to convert the string to the data type desired.

Currently, I'm working on building a Tenable integration for Resilient. I need to pass more complex tuples through to the functions as parameters. The method I had been using will not work for these (as my prior method was for simple tuples with one set of parentheses.

Is there a better way to do this, other than using clunky string manipulation methods within the function? If not, does anyone have a method already designed for this?

Example:
inputs.tenable_filter = ('severity', '=', '4'), ('exploitAvailable', '=', 'true')
# Above results in: ​​"Unable to set value [[severity, =, 4], [exploitAvailable, =, true]] for Field tenable_filter"


------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility
------------------------------

Hi Jared,

We have the same problem with this and other data structures such as dictionaries. Our solution is to specify the structure as a string (we cast it) and then we parse it on circuits using ast module:

# This happens on the pre-process scripts
my_dict = {'name': 'Carlos', 'lastname': 'Ortigoza', 'company': 'Nestlé'}
inputs.my_input = str(my_dict)

# And this happens on Circuits side
import ast

my_dict = kwargs.get('mt_param', '{}')
my_dict = ast.literal_eval(my_dict)

name = my_dict.get('name')
lastname = my_dict.get('lastname')
company = my_dict.get('company')
age = my_dict.get('age', None)​

Notice that this is still a workaround as Resilient still does not provide any way to pass non-primitive data types (which is pretty unfortunate, as in the pre-process scripts you can define any structure) but at least you don't have to use eval (with the risks it would imply.

Hopefully this will work in your situation.

Regards,
Carlos

------------------------------
Carlos Ortigoza
------------------------------

Carlos,

This is a solid workaround. I have not used literal_eval() in the past, but will use this going forward. It appears to work well.

Is there a posted idea in the aha portal on this? I was unable to locate one, but will post one gladly.

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility
------------------------------

Original Message:
Sent: Mon September 23, 2019 04:19 AM
From: Carlos Ortigoza
Subject: Passing Function Parameters of Type Tuple

Hi Jared,

We have the same problem with this and other data structures such as dictionaries. Our solution is to specify the structure as a string (we cast it) and then we parse it on circuits using ast module:

# This happens on the pre-process scriptsmy_dict = {'name': 'Carlos', 'lastname': 'Ortigoza', 'company': 'Nestlé'}inputs.my_input = str(my_dict)# And this happens on Circuits sideimport astmy_dict = kwargs.get('mt_param', '{}')my_dict = ast.literal_eval(my_dict)name = my_dict.get('name')lastname = my_dict.get('lastname')company = my_dict.get('company')age = my_dict.get('age', None)​

Notice that this is still a workaround as Resilient still does not provide any way to pass non-primitive data types (which is pretty unfortunate, as in the pre-process scripts you can define any structure) but at least you don't have to use eval (with the risks it would imply.

Hopefully this will work in your situation.

Regards,
Carlos

------------------------------
Carlos Ortigoza
------------------------------

Hi Jared,

I have just created it: https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-680

Hopefully if it gets some votes it will get IBM's attention.

Regards,

------------------------------
Carlos Ortigoza
------------------------------

Original Message:
Sent: Mon September 23, 2019 03:28 PM
From: Jared Fagel
Subject: Passing Function Parameters of Type Tuple

Carlos,

This is a solid workaround. I have not used literal_eval() in the past, but will use this going forward. It appears to work well.

Is there a posted idea in the aha portal on this? I was unable to locate one, but will post one gladly.

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility
------------------------------


Original Message:
Sent: Mon September 23, 2019 04:19 AM
From: Carlos Ortigoza
Subject: Passing Function Parameters of Type Tuple

Hi Jared,

We have the same problem with this and other data structures such as dictionaries. Our solution is to specify the structure as a string (we cast it) and then we parse it on circuits using ast module:

# This happens on the pre-process scriptsmy_dict = {'name': 'Carlos', 'lastname': 'Ortigoza', 'company': 'Nestlé'}inputs.my_input = str(my_dict)# And this happens on Circuits sideimport astmy_dict = kwargs.get('mt_param', '{}')my_dict = ast.literal_eval(my_dict)name = my_dict.get('name')lastname = my_dict.get('lastname')company = my_dict.get('company')age = my_dict.get('age', None)​

Notice that this is still a workaround as Resilient still does not provide any way to pass non-primitive data types (which is pretty unfortunate, as in the pre-process scripts you can define any structure) but at least you don't have to use eval (with the risks it would imply.

Hopefully this will work in your situation.

Regards,
Carlos

------------------------------
Carlos Ortigoza