Hello, Allen Lee
Sorry for the late response!
I have solved this issue
The method I used was not to extract the value from the data table, but to search for the value in SIEM using a query.
Thank you for your answer.
Have a nice day
------------------------------
Yongwon Song
------------------------------
Original Message:
Sent: Fri March 15, 2024 03:49 AM
From: Allen Lee
Subject: How to get data table values within the incident
Hi Yongwon,
Could you provide more logs to help identify which stage is causing the issue?
------------------------------
Allen Lee
Original Message:
Sent: Tue March 05, 2024 02:37 AM
From: Yongwon Song
Subject: How to get data table values within the incident
Hello, I am writing because I encountered a problem while testing email transfer using QRadar SOAR.
After receiving the log using "QRadar Enhanced Data Migration" in QRadar SIEM, the data sent through "Outbound Email" should be emailed, but the value of the incident field is getting the value through incident.properties as shown in the picture below, but the data table does not get the value.
If you have any good ideas or ideas, please help!
Have a nice day
Thank you.
------------------------------
Yongwon Song
------------------------------