Text Filters

LAST UPDATED: FEBRUARY 18, 2026

base64_decode

Returns the Base64-decoded form of the piped text.

Examples - base64_decode

EXAMPLE 1

Input:

CODE

{{ 'RDMgU2VjdXJpdHkgTWFuYWdlbWVudCBTeXN0ZW1z' | base64_decode }}

Return Data:

TEXT

D3 Security Management Systems

EXAMPLE 2

Input:

CODE

{{ 'eyAna2V5MSc6ICd2YWx1ZTEnLCAna2V5Mic6ICd2YWx1ZTInIH0=' | base64_decode }}

Return Data:

TEXT

{
  "key1": "value1",
  "key2": "value2"
}

EXAMPLE 3

Input:

CODE

{{ 'WyAnZWxlbWVudDEnLCAnZWxlbWVudDInLCAnZWxlbWVudDMnIF0=' | base64_decode }}

Return Data:

JSON

[
  "element1",
  "element2",
  "element3"
]

base64_encode

Returns the Base64-encoded form of the piped text as a Base64 string. Arrays and objects collapse to their first scalar value unless they are converted into strings before encoding.

USAGE ADVISORY

Do not use | string and | tojson interchangeably.

| string produces Python-style strings (single quotes).
| tojson produces JSON-style strings (double quotes).

Examples - base64_encode

EXAMPLE 1

Input:

CODE

{{ 'D3 Security Management Systems' | base64_encode }}

Return Data:

TEXT

RDMgU2VjdXJpdHkgTWFuYWdlbWVudCBTeXN0ZW1z

EXAMPLE 2

Input:

CODE

{{ '{ "key1": "value1", "key2": "value2" }' | base64_encode }}

Return Data:

TEXT

eyAia2V5MSI6ICJ2YWx1ZTEiLCAia2V5MiI6ICJ2YWx1ZTIiIH0

EXAMPLE 3

Input:

CODE

{{ '[ "element1", "element2", "element3" ]' | base64_encode }}

Return Data:

TEXT

WyAiZWxlbWVudDEiLCAiZWxlbWVudDIiLCAiZWxlbWVudDMiIF0=

EXAMPLE 4

Input:

CODE

{{ [ "element1", "element2", "element3" ] | tojson | base64_encode }}

Return Data:

TEXT

WyJlbGVtZW50MSIsICJlbGVtZW50MiIsICJlbGVtZW50MyJd

EXAMPLE 5

Input:

CODE

{{ [ "element1", "element2", "element3" ] | string | base64_encode }}

Return Data:

TEXT

WydlbGVtZW50MScsICdlbGVtZW50MicsICdlbGVtZW50Mydd

base64url_safe_decode

Decodes Base64URL data by accepting underscores (_) and permitting missing padding (=) in the final 4-character group, which normally causes the strict Base64 decoder to fail.

Examples - base64url_safe_decode

EXAMPLE 1

Input:

CODE

{% set encoded_url='aHR0cHM6Ly9kZW1vLmNvbS8_cT1-MDA=' %}
{{ encoded_url | base64url_safe_decode }}

Return Data:

TEXT

https://demo.com/?q=~00

Input:

CODE

{% set encoded_url='aHR0cHM6Ly9kZW1vLmNvbS8_cT1-MDA=' %}
{{ encoded_url | base64_decode }}

Error:

TEXT

Invalid base64-encoded string: number of data characters (29) cannot be 1 more than a multiple of 4

EXAMPLE 2

Input:

CODE

{% set encoded_url='aHR0cHM6Ly9kZW1vLmNvbS8_cGF0aD1kb2MlMkZ2MQ==' %}
{{ encoded_url | base64url_safe_decode }}

Return Data:

TEXT

https://demo.com/?path=doc%2Fv1

Input:

CODE

{% set encoded_url='aHR0cHM6Ly9kZW1vLmNvbS8_cGF0aD1kb2MlMkZ2MQ==' %}
{{ encoded_url | base64_decode }}

Error:

TEXT

 Invalid base64-encoded string: number of data characters (41) cannot be 1 more than a multiple of 4

EXAMPLE 3

Input:

CODE

{% set url='aHR0cHM6Ly9kZW1vLmNvbS8_cT1hfHo=' %}
{{ encoded_url | base64url_safe_decode }}

Return Data:

TEXT

https://demo.com/?q=a|z

Input:

CODE

{% set url='aHR0cHM6Ly9kZW1vLmNvbS8_cGF0aD1kb2MlMkZ2MQ==' %}
{{ encoded_url | base64_decode }}

Error:

TEXT

 Incorrect padding

base64url_safe_encode

Encodes a URL string into Base64 and applies Base64URL character substitutions by replacing the plus sign (+) with a hyphen (-) and the forward slash (/) with an underscore (_).

Examples - base64url_safe_encode

EXAMPLE 1

Input:

CODE

{% set url='https://demo.com/?q=~00' %}
{{ url | base64url_safe_encode }}

Return Data:

TEXT

aHR0cHM6Ly9kZW1vLmNvbS8_cT1-MDA=

Input:

CODE

{% set url='https://demo.com/?q=~00' %}
{{ url | base64_encode }}

Return Data:

TEXT

aHR0cHM6Ly9kZW1vLmNvbS8/cT1+MDA=

EXAMPLE 2

Input:

CODE

{% set url='https://demo.com/?path=doc%2Fv1' %}
{{ url | base64url_safe_encode }}

Return Data:

TEXT

aHR0cHM6Ly9kZW1vLmNvbS8_cGF0aD1kb2MlMkZ2MQ==

Input:

CODE

{% set url='https://demo.com/?path=doc%2Fv1' %}
{{ url | base64_encode }}

Return Data:

TEXT

aHR0cHM6Ly9kZW1vLmNvbS8/cGF0aD1kb2MlMkZ2MQ==

EXAMPLE 3

Input:

CODE

{% set url='https://demo.com/?q=a|z' %}
{{ url | base64url_safe_encode }}

Return Data:

TEXT

aHR0cHM6Ly9kZW1vLmNvbS8_cT1hfHo=

Input:

CODE

{% set url='https://demo.com/?q=a|z' %}
{{ url | base64_encode }}

Return Data:

TEXT

aHR0cHM6Ly9kZW1vLmNvbS8/cT1hfHo=

capitalize

Returns a string with the first character capitalized. When the piped input is an array, it returns the first element with its first character capitalized. When piped input is an object, it returns the first value with its first character capitalized.

Examples - capitalize

EXAMPLE 1

Input:

CODE

{{ 'd3 security' | capitalize }}

Return Data:

TEXT

D3 security

EXAMPLE 2

Input:

CODE

{{ ['openAI', 'google'] | capitalize }}

Return Data:

TEXT

Openai

EXAMPLE 3

Input:

CODE

{{ {'key1': 'value1', 'key2': 'value2'} | capitalize }}

Return Data:

TEXT

Value1

check_type(data)

Determines the data type of the provided value or variable. Supported types include:

array (list)
BlockReference
boolean (bool)
bytes
Cycler
dictionary / object (dict)
float

integer (int)
Joiner
LoopContext
Macro
Markup
Namespace
null / none (NoneType)

range
string (str)
TemplateReference
tuple
type
Undefined

Examples - check_type

EXAMPLE 1

Input:

CODE

{{ "D3" | check_type }}

Return Data:

TEXT

str

EXAMPLE 2

Input:

CODE

{% set cert_text = "-----BEGIN CERTIFICATE-----MIIBsjCCARugAwIBAgIU...-----END CERTIFICATE-----" %}
{% set cert_bytes = cert_text.encode("utf-8") %}
{{ cert_bytes | check_type }}

Return Data:

TEXT

bytes

EXAMPLE 3

Input:

CODE

{% set html_output = "<b>Alert Confirmed</b>" | safe %}
{{ html_output | check_type }}

Return Data:

TEXT

Markup

EXAMPLE 4

Input:

CODE

{% for i in [1, 2, 3] %}
  {{ loop | check_type }}
{% endfor %}

Return Data:

TEXT

LoopContext

LoopContext

LoopContext

csv_parse

Returns an array of objects parsed from a CSV-formatted string. How it works:

The comma-separated items before the first \n defines the keys for each object.
Each additional \n creates a new object, and the comma-separated items in that row populate the keys in order.
If a row contains fewer values than there are keys, the unmatched keys in that object receive null.
If a row provides more values than there are keys, the values shift left in sequence so that only the last N values match the N keys.

Examples - csv_parse

EXAMPLE 1

Input:

CODE

{{ 'a,b\nD3,1' | csv_parse }}

Return Data:

JSON

[
  {
    "a": "D3",
    "b": 1
  }
]

EXAMPLE 2

Input:

CODE

{{ 'a,b\nD3,Security' | csv_parse }}

Return Data:

JSON

[
  {
    "a": "D3",
    "b": "Security"
  }
]

EXAMPLE 3

Input:

CODE

{{ 'a,b\nD3,Security\nManagement,Systems' | csv_parse }}

Return Data:

JSON

[
  {
    "a": "D3",
    "b": "Security"
  },
  {
    "a": "Management",
    "b": "Systems"
  }
]

EXAMPLE 4

Input:

CODE

{{ 'a,b\nA,B\nC' | csv_parse }}

Return Data:

JSON

[
  {
    "a": "A",
    "b": "B"
  },
  {
    "a": "C",
    "b": null
  }
]

EXAMPLE 5

Input:

CODE

{{ 'a,b,c\ntrue,false,1,2' | csv_parse }}

Return Data:

JSON

[
  {
    "a": false,
    "b": 1,
    "c": 2
  }
]

defang_url

Returns a defanged URL string. Defanging replaces specific URL characters with safe alternatives to prevent the URL from functioning as a clickable link. How it works:

Schemes (http, https, ftp) are rewritten into obfuscated forms (hXXp, hXXps, fXp).
The colon following a valid scheme becomes [:] (http[:]//).
Dot characters in IPv4 dotted-quad patterns are placed inside square brackets ([.]) for hostnames, path segments, query parameters, fragment components, and userinfo suffixes.
If the text before :// is not a valid scheme, up to the last 12 characters of that text are placed inside parentheses.

LIMITATIONS

No defanging of IPv6 literal hosts enclosed in brackets.
No modification of IPv4 integer-encoded hosts.

Examples - defang_url

EXAMPLE 1

Input:

CODE

{{ 'https://example.com/x/9.9.9.9' | defang_url }}

Return Data:

TEXT

hXXps[:]//example[.]com/x/9[.]9[.]9[.]9

EXAMPLE 2

Input:

CODE

{{ 'https://192.168.1.5' | defang_url }}

Return Data:

TEXT

hXXps[:]//192[.]168[.]1[.]5

EXAMPLE 3

Input:

CODE

ftp://example.com/x

Return Data:

TEXT

fXp[:]//example[.]com/x

EXAMPLE 4

Input:

CODE

{{ 'https://demo.com/?ip=1.2.3.4' | defang_url }}

Return Data:

TEXT

hXXps[:]//demo[.]com/?ip=1[.]2[.]3[.]4

EXAMPLE 5

Input:

CODE

{{ 'a:b.1.2.3.4@host.com' | defang_url }}

Return Data:

TEXT

a:b.1[.]2[.]3[.]4@host[.]com

EXAMPLE 6

Input:

CODE

{{ 'https://example.com/#seen-5.6.7.8' | defang_url }}

Return Data:

TEXT

hXXps[:]//example[.]com/#seen-5[.]6[.]7[.]8

EXAMPLE 7

Input:

CODE

{% set url = "zyxwvutsrqpon://www.demo.download/x" %}
{{ url | defang_url }}

Return Data:

TEXT

z(yxwvutsrqpon)[:]//www[.]demo[.]download/x

default(default_value)

Returns a fallback value when the provided variable is undefined or empty. If the variable is defined, the original value is returned unchanged.

Examples - default

EXAMPLE 1

Input:

CODE

{{ data | default("Variable is not defined.") }}

Return Data:

TEXT

Variable is not defined.

Input:

CODE

{% set data = "D3" %}
{{ data | default("Variable is not defined.") }}

Return Data:

TEXT

D3

EXAMPLE 2

Input:

CODE

{% set alert = {"type": "Phishing Email", "severity": "high"} %}
{{ alert.non_existent_attribute | default("medium") }}

Return Data:

TEXT

medium

Input:

CODE

{% set alert = {"type": "Phishing Email", "severity": "high"} %}
{{ alert.severity | default("medium") }}

Return Data:

TEXT

high

downcase(value_to_convert)

Converts all uppercase characters in the provided value to lowercase.

Examples - downcase

EXAMPLE 1

Input:

CODE

{{ "D3SECURITY" | downcase }}

Return Data:

TEXT

d3security

EXAMPLE 2

Input:

CODE

{% set domains = ["D3SECURITY.COM", "GOOGLE.COM", "MICROSOFT.COM", "VIRUSTOTAL.COM"] %}
{{ domains | downcase }}

Return Data:

JSON

[
  "d3security.com",
  "google.com",
  "microsoft.com",
  "virustotal.com"
]

EXAMPLE 3

Input:

CODE

{% set data = {"A": "B", "C": "D"} %}
{{ data | downcase }}

Return Data:

JSON

{
  "a": "b",
  "c": "d"
}

eml_parse

Converts raw EML text into an object.

Examples - eml_parse

EXAMPLE 1

Input:

CODE

{% set eml_string = "From: emusk@d3security.com
To: lpage@d3security.com
Subject: Demo
Date: Mon, 01 Jan 2026 10:00:00 -0000

Body text." %}

{{ eml_string | eml_parse }}

Return Data:

JSON

{
  "body": [
    {
      ...
      "hash": "4319*****48a5"
    }
  ],
  "header": {
    "subject": "Demo",
    "from": "emusk@d3security.com",
    "to": [
      "lpage@d3security.com"
    ],
    "date": "2026-01-01T10:00:00+00:00",
    "received": [],
    "header": {
      ...
    }
  }
}

EXAMPLE 2

Input:

CODE

{% set eml_string = "Content-Type: text/plain; charset=utf-8" %}
{{ eml_string | eml_parse }}

Return Data:

JSON

{
  "body": [
    {
      "content_header": {
        "content-type": [
          "text/plain; charset=\"utf-8\""
        ]
      },
      "content_type": "text/plain",
      "hash": "e3b0*****b855"
    }
  ],
  "header": {
    ...
  }
}

EXAMPLE 3

Input:

CODE

{% set eml_string = "Received: from hostA 203.0.113.1 by hostB 198.51.100.2 with SMTP; Tue, 02 Jan 2026 09:00:00 -0000" %}
{{ eml_string | eml_parse }}

Return Data:

JSON

{
  "body": [
    {
      "content_header": {},
      "hash": "e3b0*****b855"
    }
  ],
  "header": {
    "subject": "",
    "to": [],
    "date": "1970-01-01T00:00:00+00:00",
    "received": [
      {
        "src": "from hosta 203.0.113.1 by hostb 198.51.100.2 with smtp; tue, 02 jan 2026 09:00:00 -0000",
        "from": [
          "203.0.113.1"
        ],
        "by": [
          "198.51.100.2"
        ],
        "with": "smtp",
        "date": "2026-01-02T09:00:00+00:00"
      }
    ],
    "header": {
      "received": [
        "from hostA 203.0.113.1 by hostB 198.51.100.2 with SMTP; Tue, 02 Jan 2026 09:00:00 -0000"
      ]
    }
  }
}

EXAMPLE 4

Input:

CODE

{% set eml_string = "Received: from A [203.0.113.10] by B [198.51.100.20]; Tue, 02 Jan 2026 10:00:00 -0000
Received: from C [192.0.2.5] by A [203.0.113.10]; Tue, 02 Jan 2026 09:59:50 -0000

x" %}

{{ eml_string | eml_parse }}

Return Data:

JSON

{
  "body": [
    {
      "content_header": {},
      "hash": "2d71*****4881"
    }
  ],
  "header": {
    "subject": "",
    "to": [],
    "date": "1970-01-01T00:00:00+00:00",
    "received": [
      {
        "src": "from a [203.0.113.10] by b [198.51.100.20]; tue, 02 jan 2026 10:00:00 -0000",
        "from": [
          "203.0.113.10"
        ],
        "by": [
          "198.51.100.20"
        ],
        "date": "2026-01-02T10:00:00+00:00"
      },
      {
        "src": "from c [192.0.2.5] by a [203.0.113.10]; tue, 02 jan 2026 09:59:50 -0000",
        "from": [
          "192.0.2.5"
        ],
        "by": [
          "203.0.113.10"
        ],
        "date": "2026-01-02T09:59:50+00:00"
      }
    ],
    "header": {
      "received": [
        "from A [203.0.113.10] by B [198.51.100.20]; Tue, 02 Jan 2026 10:00:00 -0000",
        "from C [192.0.2.5] by A [203.0.113.10]; Tue, 02 Jan 2026 09:59:50 -0000"
      ]
    }
  }
}

EXAMPLE 5

Input:

CODE

{% set eml_string = "Message-ID: <demo@d3security.com>" %}
{{ eml_string | eml_parse }}

Return Data:

JSON

{
  "body": [
    {
      "content_header": {},
      "hash": "e3b0*****b855"
    }
  ],
  "header": {
    "subject": "",
    "to": [],
    "date": "1970-01-01T00:00:00+00:00",
    "received": [],
    "header": {
      "message-id": [
        "<demo@d3security.com>"
      ]
    }
  }
}

EXAMPLE 6

Input:

CODE

{% set eml_string = "MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
From: Sender Name <sender@example.com>
To: Recipient Name <recipient@example.com>
Subject: Quarterly Report Update
Date: Fri, 12 Apr 2026 11:30:00 -0000
Message-ID: <1767334200.12345@example.com>
Received: from mailout.example.net (mailout.example.net [203.0.113.10])
        by mx.example.com (Postfix) with ESMTPS id 4F2A812345
        for <recipient@example.com>; Fri, 12 Apr 2026 11:29:59 -0000
Received: from userpc.internal (userpc.internal [192.0.2.55])
        by mailout.example.net (Postfix) with ESMTPSA id 9B7C412345
        for <recipient@example.com>; Fri, 12 Apr 2026 11:29:57 -0000

Hello team,
This message confirms the updated schedule for the quarterly report." %}

{{ eml_string | eml_parse }}

Return Data:

JSON

{
  "body": [
    {
      "content_header": {
        "content-type": [
          "text/plain; charset=\"utf-8\""
        ],
        "content-transfer-encoding": [
          "7bit"
        ]
      },
      "content_type": "text/plain",
      "hash": "dc2d*****6695"
    }
  ],
  "header": {
    "subject": "Quarterly Report Update",
    "from": "sender@example.com",
    "to": [
      "recipient@example.com"
    ],
    "date": "2026-04-12T11:30:00+00:00",
    "received": [
      {
        "src": "from mailout.example.net (mailout.example.net [203.0.113.10]) by mx.example.com (postfix) with esmtps id 4f2a812345 for <recipient@example.com>; fri, 12 apr 2026 11:29:59 -0000",
        "from": [
          "203.0.113.10",
          "mailout.example.net"
        ],
        "by": [
          "mx.example.com"
        ],
        "with": "esmtps id 4f2a812345",
        "for": [
          "recipient@example.com"
        ],
        "date": "2026-04-12T11:29:59+00:00"
      },
      {
        "src": "from userpc.internal (userpc.internal [192.0.2.55]) by mailout.example.net (postfix) with esmtpsa id 9b7c412345 for <recipient@example.com>; fri, 12 apr 2026 11:29:57 -0000",
        "from": [
          "192.0.2.55",
          "userpc.internal"
        ],
        "by": [
          "mailout.example.net"
        ],
        "with": "esmtpsa id 9b7c412345",
        "for": [
          "recipient@example.com"
        ],
        "date": "2026-04-12T11:29:57+00:00"
      }
    ],
    "received_domain": [
      "mx.example.com",
      "userpc.internal",
      "mailout.example.net"
    ],
    "received_foremail": [
      "recipient@example.com"
    ],
    "header": {
      "message-id": [
        "<1767334200.12345@example.com>"
      ],
      "from": [
        "Sender Name <sender@example.com>"
      ],
      "to": [
        "Recipient Name <recipient@example.com>"
      ],
      "date": [
        "Sun, 12 Apr 2026 11:30:00 -0000"
      ],
      "content-type": [
        "text/plain; charset=\"utf-8\""
      ],
      "mime-version": [
        "1.0"
      ],
      "received": [
        "from mailout.example.net (mailout.example.net [203.0.113.10]) by mx.example.com (Postfix) with ESMTPS id 4F2A812345 for <recipient@example.com>; Fri, 12 Apr 2026 11:29:59 -0000",
        "from userpc.internal (userpc.internal [192.0.2.55]) by mailout.example.net (Postfix) with ESMTPSA id 9B7C412345 for <recipient@example.com>; Fri, 12 Apr 2026 11:29:57 -0000"
      ],
      "content-transfer-encoding": [
        "7bit"
      ],
      "subject": [
        "Quarterly Report Update"
      ]
    }
  }
}

end_with

Returns a Boolean value that indicates whether the piped input ends with the comparison string.

Examples - end_with

EXAMPLE 1

Input:

CODE

{{ "D3 Security" | end_with("y") }}

Return Data:

TEXT

True

EXAMPLE 2

Input:

CODE

{{ "D3 Security" | end_with("Security") }}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{{ "D3 Security" | end_with("D3") }}

Return Data:

TEXT

False

equals(value)

Returns a Boolean indicating whether two input values are identical in content and type. Supports comparison of strings, objects, arrays, and numbers.

Examples - equals

EXAMPLE 1

Input:

CODE

{{ "D3Security" | equals("d3security") }}

Return Data:

TEXT

False

EXAMPLE 2

Input:

CODE

{% set alert1 = {
  "alert_id": "INC-48392",
  "threat_type": "phishing",
  "severity": "high",
  "source": "splunk"
} %}

{% set alert2 = {
  "alert_id": "INC-48392",
  "threat_type": "phishing",
  "severity": "high",
  "source": "splunk"
} %}

{{ alert1 | equals(alert2) }}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{% set baseline_hashes = [
  "b7f9a3d2e4c6f8b92a47d5c1aa12bb34ef9c8902e2345ab19f37da7c1234eac1",
  "9a81b02f4cc5b7a0fbc21c5a923e2d3aa87f02b5cc99e3311a9f7df25f91d2c4",
  "a7d2c09fbd11e3b9b4a56f9320e57dfb88e5fa17d0b14a7bcd90a0f7adcefa91"
] %}

{% set recent_hashes = [
  "b7f9a3d2e4c6f8b92a47d5c1aa12bb34ef9c8902e2345ab19f37da7c1234eac1",
  "9a81b02f4cc5b7a0fbc21c5a923e2d3aa87f02b5cc99e3311a9f7df25f91d2c4",
  "a7d2c09fbd11e3b9b4a56f9320e57dfb88e5fa17d0b14a7bcd90a0f7adcefa91"
] %}

{{ baseline_hashes | equals(recent_hashes) }}

Return Data:

TEXT

True

escape_once

Returns a string that applies HTML escaping to unescaped characters once. It preserves characters already represented as HTML entities and leaves all other characters unchanged.

Examples - escape_once

EXAMPLE 1

Input:

CODE

{{ '&amp;&' | escape_once }}

Return Data:

TEXT

&amp;&amp;

EXAMPLE 2

Input:

CODE

{{ '<>' | escape_once }}

Return Data:

TEXT

&lt;&gt;

EXAMPLE 3

Input:

CODE

{{ 'x"y\\\'z' | escape_once }}

Return Data:

TEXT

x&quot;y\&#x27;z

EXAMPLE 4

Input:

CODE

{{ '©&✓' | escape_once }}

Return Data:

TEXT

©&amp;✓

Explanation: Unicode characters remain unchanged.

first

Returns the first character of a string or the first element of an array.

Examples - first

EXAMPLE 1

Input:

CODE

{{ "Threat" | first }}

Return Data:

TEXT

EXAMPLE 2

Input:

CODE

{% set vendors = ["D3 Security", "CrowdStrike", "Palo Alto Networks"] %}
{{ vendors | first }}

Return Data:

TEXT

D3 Security

format(arg1, arg2, arg3, …, argN)

Returns a string that contains the result of replacing each format specifier in the piped-input template string with the corresponding formatted argument value.

Supported Format Specifiers

Format specifiers define how each argument is converted into text when substituted into the template string.

Specifiers	Description
`%a`	Converts the argument to an ASCII-only representation.
`%c`	Formats the argument as a single character. Accepts an integer code point or a single-character string.
`%d`	Formats the argument as a signed decimal integer. Requires a numeric argument.
`%E`	Formats a floating-point value in uppercase scientific notation. Requires a real number.
`%e`	Formats a floating-point value in lowercase scientific notation. Requires a real number.
`%F`	Formats a floating-point value using uppercase fixed-point notation with six decimal places. Requires a real number.
`%f`	Formats a floating-point value using fixed-point notation with six decimal places. Requires a real number.
`%G`	Formats a floating-point value using the shortest uppercase representational form. Requires a real number.
`%g`	Formats a floating-point value using the shortest representational form. Requires a real number.
`%i`	Same as %d. Formats a signed decimal integer. Requires a numeric argument.
`%o`	Formats the argument as an octal integer. Requires a numeric argument.
`%r`	Converts the argument to its repr-style string form.
`%s`	Converts the argument to a string representation. Accepts any type.
`%u`	Formats the argument as an unsigned decimal integer. Requires a numeric argument.
`%X`	Formats the argument as an uppercase hexadecimal integer. Requires a numeric argument.
`%x`	Formats the argument as a lowercase hexadecimal integer. Requires a numeric argument.
`%%`	Inserts a literal percent sign.

Examples - format

EXAMPLE 1

Input:

CODE

{{ 'ASCII-safe: %a' | format('Malware: ☠️') }}

Return Data:

TEXT

ASCII-safe: 'Malware: \u2620\ufe0f'

EXAMPLE 2

Input:

CODE

{{ 'Symbol: %c' | format(10004) }}

Return Data:

TEXT

Status Symbol: ✔

EXAMPLE 3

Input:

CODE

{{ 'Truncated Int: %d' | format(55.9) }}

Return Data:

TEXT

Truncated Int: 55

EXAMPLE 4

Input:

CODE

{{ 'Trace Amount: %e' | format(0.00000005) }}

Return Data:

TEXT

Trace Amount: 5.000000e-08

EXAMPLE 5

Input:

CODE

{{ 'Capacity: %E' | format(10000000000) }}

Return Data:

TEXT

Capacity: 1.000000E+10

EXAMPLE 6

Input:

CODE

{{ 'Rounding: %f' | format(0.6666669) }}

Return Data:

TEXT

Rounding: 0.666667

EXAMPLE 7

Input:

CODE

{{ 'Uppercase Inf: %F' | format(1e400) }}

Return Data:

TEXT

Uppercase Inf: INF

EXAMPLE 8

Input:

CODE

{{ 'Smart Float: %g' | format(42.0000) }}

Return Data:

TEXT

Smart Float: 42

EXAMPLE 9

Input:

CODE

{{ 'Smart Notation: %G' | format(0.0000004) }}

Return Data:

TEXT

Smart Notation: 4E-07

EXAMPLE 10

Input:

CODE

{{ 'Hex to Dec: %i' | format(0xFF) }}

Return Data:

TEXT

Hex to Dec: 255

EXAMPLE 11

Input:

CODE

{{ 'Permissions: %o' | format(493) }}

Return Data:

TEXT

Permissions: 755

EXAMPLE 12

Input:

CODE

{{ 'Raw Payload: %r' | format("curl -v\nexit") }}

Return Data:

TEXT

Raw Payload: 'curl -v\nexit'

Input:

CODE

{{ 'Raw Payload: %s' | format("curl -v\nexit") }}

Return Data:

TEXT

Raw Payload: curl -v
exit

EXAMPLE 13

Input:

CODE

{{ 'Geo-Location: %s' | format(None) }}

Return Data:

TEXT

Geo-Location: None

EXAMPLE 14

Input:

CODE

{{ 'Obsolete Unsigned: %u' | format(-50) }}

Return Data:

TEXT

Obsolete Unsigned: -50

EXAMPLE 15

Input:

CODE

{{ 'Hash prefix (HEX): %X' | format(43981) }}

Return Data:

TEXT

Hash prefix (HEX): ABCD

EXAMPLE 16

Input:

CODE

{{ 'Hash prefix (hex): %x' | format(43981) }}

Return Data:

TEXT

Hash prefix (hex): abcd

EXAMPLE 17

Input:

CODE

{{ 'Confidence: %d%%' | format(98) }}

Return Data:

TEXT

Confidence: 98%

EXAMPLE 18

Input:

CODE

{{ 'Alert #%d: %s | Risk Score: %g | IOC: 0x%X | Confidence: 100%%' | format(
    4201,
    'SQL Injection',
    9.85,
    3735928559
) }}

Return Data:

TEXT

Alert #4201: SQL Injection | Risk Score: 9.85 | IOC: 0xDEADBEEF | Confidence: 100%

hmac_sha1(secret_key)

Returns an HMAC value produced by the HMAC-SHA-1 algorithm using a required string key.

Examples - hmac_sha1

EXAMPLE 1

Input:

CODE

{{ 'a' | hmac_sha1('a') }}

Return Data:

TEXT

3902ed847ff28930b5f141abfa8b471681253673

EXAMPLE 2

Input:

CODE

{{ 'a' | hmac_sha1('a') }} 
{{ 'a' | hmac_sha1('b') }} 
{{ 'a' | hmac_sha1('c') }}

Return Data:

TEXT

3902ed847ff28930b5f141abfa8b471681253673 
8abe0fd691e3da3035f7b7ac91be45d99e942b9e 
9ca0a64ffd017c8620a7ab97bb97f4eec24e7e3e

EXAMPLE 3

Input:

CODE

{% set k = 'v' %}
{{ 'a' | hmac_sha1(k) }}

Return Data:

TEXT

df27de10ed592a7ee0b7827fe75b1d427fe18177

EXAMPLE 4

Input:

CODE

{% set d = {'k': 'v'} %}
{{ 'a' | hmac_sha1(d.k) }}

Return Data:

TEXT

df27de10ed592a7ee0b7827fe75b1d427fe18177

hmac_sha256(secret_key)

Returns an HMAC value produced by the HMAC-SHA-256 algorithm using a required string key.

Examples - hmac_sha256

EXAMPLE 1

Input:

CODE

{{ 'a' | hmac_sha256('a') }}

Return Data:

TEXT

3ecf5388e220da9e0f919485deb676d8bee3aec046a779353b463418511ee622

EXAMPLE 2

Input:

CODE

{{ 'a' | hmac_sha256('a') }} 
{{ 'a' | hmac_sha256('b') }} 
{{ 'a' | hmac_sha256('c') }}

Return Data:

TEXT

3ecf5388e220da9e0f919485deb676d8bee3aec046a779353b463418511ee622
cb448b440c42ac8ad084fc8a8795c98f5b7802359c305eabd57ecdb20e248896
97147e195dcf6b8be82ea572237a3e3cb34be106681818b5d8b05d1489014f8e

EXAMPLE 3

Input:

CODE

{% set k = 'v' %}
{{ 'a' | hmac_sha256(k) }}

Return Data:

TEXT

d525dbdcf0cc1f2a9f89a44468661ac2c91cb486af91e8691d9fcc05c515bf65

EXAMPLE 4

Input:

CODE

{% set d = {'k': 'v'} %}
{{ 'a' | hmac_sha256(d.k) }}

Return Data:

TEXT

d525dbdcf0cc1f2a9f89a44468661ac2c91cb486af91e8691d9fcc05c515bf65

hmtl_escape

Returns a string that replaces <, >, &, " and ' characters used to form HTML markup with their corresponding escape sequences.

Examples - hmtl_escape

EXAMPLE 1

Input:

CODE

{{ '<' | html_escape }}

Return Data:

TEXT

&lt;

EXAMPLE 2

Input:

CODE

{{ '>' | html_escape }}

Return Data:

TEXT

&gt;

EXAMPLE 3

Input:

CODE

{{ '&' | html_escape }}

Return Data:

TEXT

&amp;

EXAMPLE 4

Input:

CODE

{{ "'" | html_escape }}

Return Data:

TEXT

&#x27;

EXAMPLE 5

Input:

CODE

{{ '<a href="https://docs.d3security.com/">Tech Docs</a>' | html_escape }}

Return Data:

TEXT

&lt;a href=&quot;https://docs.d3security.com/&quot;&gt;Tech Docs&lt;/a&gt;

hmtl_json_parse

Returns a string that replaces HTML tag delimiters (< and >) and ampersands (&) in the piped input with their Unicode escape sequences.

Examples - hmtl_json_parse

EXAMPLE 1

Input:

CODE

{{ '<div>D3 Security</div>' | html_json_parse }}

Return Data:

TEXT

"\u003cdiv\u003eD3 Security\u003c/div\u003e"

EXAMPLE 2

Input:

CODE

{{ '<img src="https://example.com/x?y=1&z=2">' | html_json_parse }}

Return Data:

TEXT

"\u003cimg src=\"https://example.com/x?y=1\u0026z=2\"\u003e"

html_unescape

Returns a string that restores HTML escape sequences in the piped input to their original characters.

Examples - html_unescape

EXAMPLE 1

Input:

CODE

{{ '&lt;' | html_unescape }}

Return Data:

TEXT

EXAMPLE 2

Input:

CODE

{{ '&gt;' | html_unescape }}

Return Data:

TEXT

EXAMPLE 3

Input:

CODE

{{ '&amp;' | html_unescape }}

Return Data:

TEXT

EXAMPLE 4

Input:

CODE

{{ '&#x27;' | html_unescape }}

Return Data:

TEXT

EXAMPLE 5

Input:

CODE

{{ '&lt;a href=&quot;https://docs.d3security.com/&quot;&gt;Tech Docs&lt;/a&gt;' | html_unescape }}

Return Data:

TEXT

<a href="https://docs.d3security.com/">Tech Docs</a>

indent(leading_spaces)

Applies a fixed-width indentation to lines that follow a newline (\n) character in a multiline string. The indentations can be observed in the Format Builder and Playbook Data > returnData field.

Examples - indent

EXAMPLE 1

Input:

CODE

{{ 'Line1\nLine2\nLine3'| indent(4) }}

Format Builder > returnData:

TEXT

Line1
    Line2
    Line3

Playbook Data > returnData:

TEXT

Line1\n    Line2\n    Line3

EXAMPLE 2

Input:

CODE

{{ '\nLine1\nLine2'| indent(4) | replace(' ', '&nbsp;') }}

Format Builder > returnData:

TEXT

    Line1
    Line2

Playbook Data > returnData:

CODE

&nbsp;&nbsp;&nbsp;&nbsp;Line1\n&nbsp;&nbsp;&nbsp;&nbsp;Line2

json_equal(comparison_value)

Returns a Boolean indicating whether the piped input and the comparison value represent equivalent data. The comparison is case-sensitive and ignores key order in JSON objects but respects element order in arrays.

Examples - json_equal

EXAMPLE 1

Input:

CODE

{% set input1 = "{'a': 1, 'b': 2}" %}
{% set input2 = "{'b': 2, 'a': 1}" %}
{{ input1 | json_equal(input2) }}

Return Data:

TEXT

True

EXAMPLE 2

Input:

CODE

{% set input1 = "{'a': 1, 'b': 2}" %}
{% set input2 = "{'A': 1, 'b': 2}" %}
{{ input1 | json_equal(input2) }}

Return Data:

TEXT

False

EXAMPLE 3

Input:

CODE

{{ ['a', 'b'] | json_equal(['b', 'a']) }}

Return Data:

TEXT

False

EXAMPLE 4

Input:

CODE

{{ ['a', 'b'] | json_equal(['A', 'b']) }}

Return Data:

TEXT

False

JSON_string_escape

Returns an escaped representation of the piped input using JSON-style character escapes for control characters and quotes.

Examples - JSON_string_escape

EXAMPLE 1

Input:

CODE

{{ "\n" | JSON_string_escape }}
{{ "\t" | JSON_string_escape }}
{{ "\r" | JSON_string_escape }}
{{ "\f" | JSON_string_escape }}
{{ "\b" | JSON_string_escape }}

Return Data:

TEXT

\n
\t
\r
\f
\b

EXAMPLE 2

Input:

CODE

{% set s = "\"" %}
{{ s }}
{{ s | JSON_string_escape }}

Return Data:

TEXT

"
\"

EXAMPLE 3

Input:

CODE

{% set element = "\"X\" \"Y\" \"Z\"" %}
{"outer":{"middle":{"inner":[ "{{ element | JSON_string_escape }}" ]}}}

Return Data:

JSON

{
  "outer": {
    "middle": {
      "inner": [
        "\"X\" \"Y\" \"Z\""
      ]
    }
  }
}

JSON_string_unescape

Returns a string in which JSON escape sequences for control characters and double quotes are converted into their literal characters. No other backslash sequences are modified.

Examples - JSON_string_unescape

EXAMPLE 1

Input:

CODE

{% set s = "x\\ny" %}
{{ s }}
{{ s | JSON_string_unescape }}

Return Data:

TEXT

x\ny
x
y

Explanation: After Jinja collapses \\ into \, that resulting single backslash—now an ordinary literal character in the stored string—does not initiate escape-sequence processing.

EXAMPLE 2

Input:

CODE

{% set s = "D3 \\\"Security\\\""%}
{{ s }}
{{ s | JSON_string_unescape }}

Return Data:

TEXT

D3 \"Security\"
D3 "Security"

EXAMPLE 3

Input:

CODE

{% set s = "xyz\n\n\n" %}
{"k":"{{ s | replace('\n', '_') }}"}
{"k":"{{ s | JSON_string_unescape }}"}

Return Data:

TEXT

{"k":"xyz___"}
{"k":"xyz


"}

last

Returns the final character of a string or the last element of an array.

Examples - last

EXAMPLE 1

Input:

CODE

{% set company = "D3 Security Management Systems Inc." %}
{{ company | last }}

Return Data:

TEXT

EXAMPLE 2

Input:

CODE

{% set companies = ["Apple", "Microsoft", "Google"] %}
{{ companies | last }}

Return Data:

TEXT

Google

length

Returns the number of characters in a string, the number of elements in an array, or the number of key-value pairs in a JSON object.

Examples - length

EXAMPLE 1

Input:

CODE

{{ "abc" | length }}

Return Data:

TEXT

EXAMPLE 2

Input:

CODE

{{ ["a", "b"] | length }}

Return Data:

TEXT

EXAMPLE 3

Input:

CODE

{% set obj = {"a": 1, "b": 2, "c": 3, "d": 4} %}
{{ obj | length }}

Return Data:

TEXT

length_equals_to(integer)

Returns a boolean indicating whether the number of elements, characters, or key-value pairs in the input equals the specified length.

Examples - length_equals_to

EXAMPLE 1

Input:

CODE

{{ [] | length_equals_to(0) }}

Return Data:

TEXT

True

EXAMPLE 2

Input:

CODE

{{ "D3 Security" | length_equals_to(11) }}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{% set obj = {"a": 1, "b": 2, "c": 3} %}
{{ obj | length_equals_to(4) }}

Return Data:

TEXT

False

list

Converts the piped input into a list. Returns a new list containing the elements of the input sequence, string, tuple, set, or dictionary keys if the input is an object.

Examples - list

EXAMPLE 1

Input:

CODE

{{ "abc" | list }}

Return Data:

JSON

[
  "a",
  "b",
  "c"
]

EXAMPLE 2

Input:

CODE

{% set obj = {"x": 10, "y": 20} %}
{{ obj | list }}

Return Data:

JSON

[
  "x",
  "y"
]

EXAMPLE 3

Input:

CODE

{% set obj = {"x": 10, "y": 20} %}
{{ obj.values() | list }}

Return Data:

JSON

[
  10,
  20
]

lstrip

Returns a string whose leading spaces, tabs, and newlines are removed from the piped input, while all trailing whitespace is preserved.

Examples - lstrip

EXAMPLE 1

Input:

CODE

{{ '   D3' | lstrip | replace(" ", "_") }}
{{ '   D3' | replace(" ", "_") }}

Return Data:

TEXT

D3
___D3

EXAMPLE 2

Input:

CODE

{{ '\n \t x' | lstrip | replace(" ", "_") }}
{{ '\n \t x' | replace(" ", "_") }}

Return Data:

TEXT

x

_ _x

EXAMPLE 3

Input:

CODE

{{ '   x   ' | lstrip | replace(" ", "_")}}
{{ '   x   ' | replace(" ", "_")}}

Return Data:

TEXT

x___
___x___

md5_hash

Returns the 32-character hexadecimal MD5 hash of the piped input. The digest is computed from the piped input's exact string form.

Examples - md5_hash

EXAMPLE 1

Input:

CODE

{{ 'Demo' | md5_hash }}

Return Data:

TEXT

f0258b6685684c113bad94d91b8fa02a

EXAMPLE 2

Input:

CODE

{{ 3.1 | md5_hash }}
{{ '3.1' | md5_hash }}
{{ "3.1" | md5_hash }}

Return Data:

TEXT

5b068a95442c7d5505b4166a77357ea5
5b068a95442c7d5505b4166a77357ea5
5b068a95442c7d5505b4166a77357ea5

EXAMPLE 3

Input:

CODE

{{ false | md5_hash }}
{{ 'False' | md5_hash }}
{{ "False" | md5_hash }}

Return Data:

TEXT

f8320b26d30ab433c5a54546d21f414c
f8320b26d30ab433c5a54546d21f414c
f8320b26d30ab433c5a54546d21f414c

EXAMPLE 4

Input:

CODE

{{ ['D3','Security'] | md5_hash }}
{{ "['D3','Security']" | md5_hash }}

Return Data:

TEXT

a3deb6e481689f1d3303caecb8a6c401
2e84304c4a5ad567fba6cb8490f93c67

EXAMPLE 5

Input:

CODE

{{ {'k':'v'} | md5_hash }}
{{ "{'k':'v'}" | md5_hash }}

Return Data:

TEXT

9e3669d19b675bd57058fd4664205d2a
8ee1643ed3d348d4674dc0422bbd3b18

newline_to_br

Returns a string whose newline (\n) characters in the piped input are replaced with <br/> tags.

Examples - newline_to_br

EXAMPLE 1

Input:

CODE

{{ 'x\ny' | newline_to_br }}

Return Data:

TEXT

x<br/>y

EXAMPLE 2

Input:

CODE

{{ 'D3\nSecurity\nManagement\nSystems' | newline_to_br }}

Return Data:

TEXT

D3<br/>Security<br/>Management<br/>Systems

not_end_with(compare_string)

Returns a Boolean value indicating whether the piped input does not end with the comparison string. The comparison uses the piped input's exact stringified form, and the comparison string must match the ending substring character-for-character.

USAGE ADVISORY

Pipe array or object data through tojson before using this filter to mitigate unpredictable string representations. See example 4.

Examples - not_end_with

EXAMPLE 1

Input:

CODE

{{ '8.8.8.8' | not_end_with('.8.8') }}

Return Data:

TEXT

False

EXAMPLE 2

Input:

CODE

{{ 42 | not_end_with('8') }}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{% set my_list = [
  {'a': 1},
  {'b': 2}
] %}

{{ my_list | not_end_with('"b": 2}]') }}

Return Data:

TEXT

True

EXAMPLE 4

Input:

CODE

{% set my_list = [
  {'a': 1},
  {'b': 2}
] %}

{{ my_list | tojson | not_end_with('"b": 2}]') }}

Return Data:

TEXT

False

EXAMPLE 5

Input:

CODE

{% set my_list = [
  {'a': 1},
  {'b': 2}
] %}

{{ my_list | tojson | not_end_with('[{"a": 1}, {"b": 2}]') }}

Return Data:

TEXT

False

not_equal(comparison_value)

Determines whether the piped input value differs from the specified comparison value. Returns True if the two values are different. Returns False if they are identical.

Examples - not_equal

EXAMPLE 1

Input:

CODE

{{ "a" | not_equal("b") }}

Return Data:

TEXT

True

EXAMPLE 2

Input:

CODE

{{ [1,2,3] | not_equal([1,2,3]) }}

Return Data:

TEXT

False

EXAMPLE 3

Input:

CODE

{% set object_a = {"id": 1} %}  
{% set object_b = {"id": 2} %}  
{{ object_a | not_equal(object_b) }}

Return Data:

TEXT

True

not_start_with(compare_string).

Returns a Boolean value indicating whether the piped input does not begin with the compare string.

USAGE ADVISORY

Pipe array or object data through tojson before using this filter to mitigate unpredictable string representations. See example 4.

Examples - not_start_with

EXAMPLE 1

Input:

CODE

{{ '8.8.8.8' | not_start_with('8.8.') }}

Return Data:

TEXT

False

EXAMPLE 2

Input:

CODE

{{ 42 | not_start_with('7') }}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{% set my_list = [
  {'a': 1},
  {'b': 2}
] %}

{{ my_list | not_start_with('[{"a": 1},') }}
{{ my_list | not_start_with("[{'a': 1},") }}

Return Data:

TEXT

True
True

EXAMPLE 4

Input:

CODE

{% set my_list = [
  {'a': 1},
  {'b': 2}
] %}

{{ my_list | tojson | not_start_with('[{"a": 1},') }}

Return Data:

TEXT

False

EXAMPLE 5

Input:

CODE

{% set my_list = [
  {'a': 1},
  {'b': 2}
] %}

{{ my_list | tojson | not_start_with('[{"a": 1}, {"b": 2}]') }}

Return Data:

TEXT

False

pluralize(number)

Returns the plural form of the piped input. The output remains the unmodified piped input when the parameter equals 1, and becomes a plural form for all other numbers.

Examples - pluralize

EXAMPLE 1

Input:

CODE

{{ 'alert' | pluralize }}

Return Data:

TEXT

alerts

EXAMPLE 2

Input:

CODE

{{ 'criterion' | pluralize(1) }}
{{ 'criterion' | pluralize(2) }}

Return Data:

TEXT

criterion
criteria

EXAMPLE 3

Input:

CODE

{{ 'analysis' | pluralize }}
{{ 'analysis' | pluralize(1) }}
{{ 'analysis' | pluralize(2) }}

Return Data:

TEXT

analyses
analysis
analyses

EXAMPLE 4

Input:

CODE

{% set case = {
    "label": "security incident",
    "count": 2
} %}

{{ case.label | pluralize(case.count) }}

Return Data:

TEXT

security incidents

EXAMPLE 5

Input:

CODE

{% set arr = ["person", "index", "datum"] %}

{{ arr[0] | pluralize }}
{{ arr[1] | pluralize }}
{{ arr[2] | pluralize }}

Return Data:

TEXT

people
indexes
data

plus(added_value)

Returns the sum for numeric inputs or a combined sequence for strings, arrays, or objects. For objects with shared keys, values from the added value override those in the piped input.

Examples - plus

EXAMPLE 1

Input:

CODE

{{ 'D3' | plus( ' Security' ) }}

Return Data:

JSON

D3 Security

EXAMPLE 2

Input:

CODE

{{ [1,2,3] | plus([1,2]) }}

Return Data:

TEXT

[
  1,
  2,
  3,
  1,
  2
]

EXAMPLE 3

Input:

CODE

{% set numbers = {"a": 2, "b": 3} %}  
{{ numbers.a | plus(numbers.b) }}

Return Data:

JSON

EXAMPLE 4

Input:

CODE

{{ {"x":1,"y":2} | plus({"y":5,"z":9}) }}

Return Data:

JSON

{
  "x": 1,
  "y": 5,
  "z": 9
}

pprint

Returns the literal representation of the piped input.

Examples - pprint

EXAMPLE 1

Input:

CODE

Normal: {{ '' }}
pprint: {{ '' | pprint }}

Return Data:

TEXT

Normal:
pprint: ''

EXAMPLE 2

Input:

CODE

Normal: {{ ' ' }}
pprint: {{ ' ' | pprint }}

Return Data:

TEXT

Normal:
pprint: ' '

EXAMPLE 3

Input:

CODE

Normal: {{ 'line\nbreak' }}
pprint: {{ 'line\nbreak' | pprint }}

Return Data:

TEXT

Normal: line
break
pprint: 'line\nbreak'

EXAMPLE 4

Input:

CODE

Normal: {{ '\\path\\to\\file' }}
pprint: {{ '\\path\\to\\file' | pprint }}

Return Data:

TEXT

Normal: \path\to\file
pprint: '\\path\\to\\file'

EXAMPLE 5

Input:

CODE

Normal: {{ 'D3 ' }}
pprint: {{ 'D3 ' | pprint }}

Return Data:

TEXT

Normal: D3
pprint: 'D3 '

EXAMPLE 6

Input:

CODE

Normal: {{ '{"a":1}' }}
pprint: {{ '{"a":1}' | pprint }}

Return Data:

TEXT

Normal: {"a":1}
pprint: '{"a":1}'

random_element

Returns a single element selected at random from the input array.

Examples - random_element

EXAMPLE 1

Input:

CODE

{{ ['x', 'y', 'z'] | random_element }}

Return Data:

TEXT

or

TEXT

or

TEXT

EXAMPLE 2

Input:

CODE

{{ [ 22, 80, 443, 3389] | random_element }}

Return Data:

TEXT

or

TEXT

or

TEXT

or

TEXT

regex_match(pattern, flag)

Returns a Boolean indicating whether the input string contains a substring that matches the provided regular expression pattern. Optional string flags include:

Flags	Function
I	Enables case-insensitive matching.
S	Allows the dot (`.`) to match newline characters.
X	Enables extended mode, allowing spaces and comments in the pattern for readability.

RELATED RESOURCES

Regular Expressions

Examples - regex_match

EXAMPLE 1

Input:

CODE

{{ '192.168.1.29' 
   | regex_match('^192\.168\.1\.([3-9][0-9]|1[0-9]{2}|2[0-3][0-9]|240)$')
}}

See escaping, start anchors, end anchors, ranges, exact repetition and alternation.

Return Data:

TEXT

False

EXAMPLE 2

Input:

CODE

{{ '192.168.1.30' 
   | regex_match('^192\.168\.1\.([3-9][0-9]|1[0-9]{2}|2[0-3][0-9]|240)$')
}}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{{ '192.168.1.241' 
   | regex_match('^192\.168\.1\.([3-9][0-9]|1[0-9]{2}|2[0-3][0-9]|240)$')
}}

Return Data:

TEXT

False

regex_replace_text_substring(pattern, new_substring, replacement_count, flag)

Returns updated text by replacing pattern-matched substrings with a new substring for the defined number of replacements. All matches are replaced when no replacement count is provided.

Examples - regex_replace_text_substring

EXAMPLE 1

Input:

CODE

{{ 'D6 E7 F8 G9' | regex_replace_text_substring('[0-9]', '3', 1) }}

See ranges.

Return Data:

TEXT

D3 E7 F8 G9

EXAMPLE 2

Input:

CODE

{{ ['user1@gmail.com','user2@hotmail.com','user3@d3.com'] 
   | tojson
   | regex_replace_text_substring('@[^"]*\.com', '@d3security.com')
}}

See literal characters, negations, zero or more, and escaping.

Return Data:

JSON

[
  "user1@d3security.com",
  "user2@d3security.com",
  "user3@d3security.com"
]

EXAMPLE 3

Input:

CODE

{{ {
      "level1": {
        "level2": {
          "src": "10.0.5.12",
          "dst": "172.16.8.4",
          "level3": {
            "src": "192.168.44.10",
            "dst": "10.20.1.7"
          }
        }
      }
   }
   | tojson
   | regex_replace_text_substring('"src"', '"source"')
   | regex_replace_text_substring('"dst"', '"destination"')
}}

Return Data:

JSON

{
  "level1": {
    "level2": {
      "destination": "172.16.8.4",
      "level3": {
        "destination": "10.20.1.7",
        "source": "192.168.44.10"
      },
      "source": "10.0.5.12"
    }
  }
}

regex_search(regex_string, flag)

Returns all substrings in the piped input that match the provided regular-expression pattern.

Examples - regex_search

EXAMPLE 1

Input:

CODE

{{ "A1 B2 D3" | regex_search("A[0-9] | D[0-9]") }}

See literal characters, ranges and alternations.

Return Data:

JSON

[
  "A1",
  "D3"
]

EXAMPLE 2

Input:

CODE

{{ "A1 B2 D3" | regex_search("C[0-9]") | length }}

Return Data:

TEXT

EXAMPLE 3

Input:

CODE

{{ "A123 B234 D345" | regex_search("[A-Za-z]34") }}

Return Data:

JSON

[
  "D34"
]

EXAMPLE 4

Input:

CODE

{{ "A1 B2 D3" | regex_search("d[0-9]", "I") }}

Return Data:

JSON

[
  "D3"
]

remove_first_occur_substring(substring)

Removes the first occurrence of the substring from the piped input. Matches are processed from left to right.

Examples - remove_first_occur_substring

EXAMPLE 1

Input:

CODE

{{ 'a a b b c d' | remove_first_occur_substring('a') }}

Return Data:

TEXT

a b b c d

EXAMPLE 2

Input:

CODE

{{ {
      "level1": {
        "level2": {
          "keyA":"x: valueA",
          "keyB":"x: valueB"
        }
      }
   }
   | tojson
   | remove_first_occur_substring('x: ')
}}

Return Data:

TEXT

{
  "level1": {
    "level2": {
      "keyA": "valueA",
      "keyB": "x: valueB"
    }
  }
}

EXAMPLE 3

Input:

CODE

{{ ['x', 'y', 'z', 'z']
   | tojson
   | remove_first_occur_substring('z')
}}

Return Data:

TEXT

[
  "x",
  "y",
  "",
  "z"
]

remove_substring(substring)

Removes all occurrences of the substring from the piped input. Matches are processed from left to right.

Examples - remove_substring

EXAMPLE 1

Input:

CODE

{{ 'x x y z' | remove_substring('x') }}

Return Data:

TEXT

y z

EXAMPLE 2

Input:

CODE

{{ {
      "level1": {
        "level2": {
          "keyA":"x: valueA",
          "keyB":"x: valueB"
        }
      }
   }
   | tojson
   | remove_substring('x: ')
}}

Return Data:

JSON

{
  "level1": {
    "level2": {
      "keyA": "valueA",
      "keyB": "valueB"
    }
  }
}

EXAMPLE 3

Input:

CODE

{{ ['x','xy','zx'] | tojson | remove_substring('x') }}

Return Data:

JSON

[
  "",
  "y",
  "z"
]

replace(old_value, new_value, replacement_count)

Returns updated text by replacing the old value with the new value for the defined number of replacements. All matches are replaced when no replacement count is provided.

Examples - replace

EXAMPLE 1

Input:

CODE

{{ 'D6 C4 B5 A6' | replace('6', '3', 1) }}

Return Data:

TEXT

D3 C4 B5 A6

EXAMPLE 2

Input:

CODE

{{ ['user1@d3.com','user2@d3.com','user3@gmail.com'] 
   | tojson
   | replace('@d3.com', '@d3security.com')
}}

Return Data:

JSON

[
  "user1@d3security.com",
  "user2@d3security.com",
  "user3@gmail.com"
]

EXAMPLE 3

Input:

CODE

{{ {
      "level1": {
        "level2": {
          "src": "10.0.5.12",
          "dst": "172.16.8.4",
          "level3": {
            "src": "192.168.44.10",
            "dst": "10.20.1.7"
          }
        }
      }
   }
   | tojson
   | replace('"src"', '"source"')
   | replace('"dst"', '"destination"')
}}

Return Data:

JSON

{
  "level1": {
    "level2": {
      "destination": "172.16.8.4",
      "level3": {
        "destination": "10.20.1.7",
        "source": "192.168.44.10"
      },
      "source": "10.0.5.12"
    }
  }
}

rstrip

Removes all trailing whitespace from the piped input. The filter processes characters from right to left and returns text with the ending whitespace removed.

Examples - rstrip

EXAMPLE 1

Input:

CODE

{{ 'D3   ' | rstrip | replace(" ", "_")}}
{{ 'D3   ' | replace(" ", "_")}}

Return Data:

TEXT

D3
D3___

EXAMPLE 2

Input:

CODE

{{ 'x \n \t ' | rstrip | replace(" ", "_") }}
{{ 'x \n \t ' | replace(" ", "_") }}

Return Data:

TEXT

x
x_
_ _

EXAMPLE 3

Input:

CODE

{{ '   x   ' | rstrip | replace(" ", "_")}}
{{ '   x   ' | replace(" ", "_")}}

Return Data:

TEXT

___x
___x___

serialize_json

Returns the JSON-formatted, serialized form of the piped input. A "data" key is produced when the piped input is a primitive or a list.

Examples - serialize_json

EXAMPLE 1

Input:

CODE

{{ 'x' | serialize_json }}

Return Data:

JSON

{"data": "x"}

EXAMPLE 2

Input:

CODE

{{ 3 | serialize_json }}

Return Data:

JSON

{
  "data": 3
}

EXAMPLE 3

Input:

CODE

{{ [1, 2, 3] | serialize_json }}

Return Data:

JSON

{"data": [1, 2, 3]}

EXAMPLE 4

Input:

CODE

{{ {'a':'b'} | serialize_json }} 
{{ {'a':'b'} }}

Return Data:

JSON

{"a": "b"}
{'a': 'b'}

EXAMPLE 5

Input:

CODE

{% set data = {
     'level1': {
       'level2': {
         'level3': 'x'
       }
     }
} %}
{{ data | serialize_json }}

Return Data:

JSON

{
  "level1": {
    "level2": {
      "level3": "x"
    }
  }
}

EXAMPLE 6

Input:

CODE

{{ {'x':'🔒'} | serialize_json }}
{{ {'x':'\ud83d\udd12'} | serialize_json }}

Return Data:

JSON

{"x": "\ud83d\udd12"} 
{"x": "\ud83d\udd12"}

sha256_hash

Returns a 64-character hexadecimal SHA-256 hash value.

Examples - sha256_hash

EXAMPLE 1

Input:

CODE

{{ 'D3 Security' | sha256_hash }}

Return Data:

TEXT

0aae84c4f33e1f753590c516c721e00001fc7a767010067ef4a24ac1e59e3311

EXAMPLE 2

Input:

CODE

{{ ['x','y','z'] | tojson | sha256_hash }}

Return Data:

TEXT

567a648207b52b5108eb64cb246c1b20eb4347c1f39ba0752ece72883d1c2904

EXAMPLE 3

Input:

CODE

{{ { 'k': 'v' } | tojson | sha256_hash }}

Return Data:

TEXT

4be281edc378f1c5e5eb9c15f9dbf5a80da2977981850f93553d5d70b75f1626

sha512_hash

Returns a 128-character hexadecimal SHA-512 hash value.

Examples - sha512_hash

EXAMPLE 1

Input:

CODE

{{ 'D3 Security' | sha512_hash }}

Return Data:

TEXT

a05571cc733955def2b82358fe8e436f3a0606040f4a26f8525c4475772af0584e070996f3683b03746cf8e82e760fde826b3d0184371364fbdb38b847393941

EXAMPLE 2

Input:

CODE

{{ ['x','y','z'] | tojson | sha512_hash }}

Return Data:

TEXT

ecf5e4ba54f41d70e6640f6df1508f0012b4bf696184d67eb76e830a7b507c3955ed67a388b6a38a4941a90a587a87b95ae52bb00315bce87e0d9b5f0a5fd55b

EXAMPLE 3

Input:

CODE

{{ { 'k': 'v' } | tojson | sha512_hash }}

Return Data:

TEXT

032272fc2357645e03a3015ac1e237503179d82f7db97717dbc9af4f81fdb79d0341cef7f0f39eaf90df141d518bf99ed1a742ae4c48d81a32f52cff62191dcb

slice(start_index, substring_length)

Returns a substring extracted from the piped input, beginning at the specified start index and continuing left to right for the defined substring length. By default, the substring length is 1.

Examples - slice

EXAMPLE 1

Input:

CODE

{{ 'D3 Security Management Systems' | slice(0,11) }}

Return Data:

TEXT

D3 Security

EXAMPLE 2

Input:

CODE

{{ 'D3 Security Management Systems' | slice(12) }}

Return Data:

TEXT

EXAMPLE 3

Input:

CODE

{{ 'D3 Security Management Systems' | slice(-7,7) }}

Return Data:

TEXT

Systems

split(delimiter)

Returns an array generated by splitting the input string into tokens, using the chosen delimiter, that become individual elements.

Examples - split

EXAMPLE 1

Input:

CODE

{{ 'D3 Security Management Systems' | split(' ') }}

Return Data:

JSON

[
  "D3",
  "Security",
  "Management",
  "Systems"
]

EXAMPLE 2

Input:

CODE

{{ 'x|y|z' | split('|') }}

Return Data:

JSON

[
  "x",
  "y",
  "z"
]

EXAMPLE 3

Input:

CODE

{{ 'comma,separated,words' | split(',') }}

Return Data:

JSON

[
  "comma",
  "separated",
  "words"
]

EXAMPLE 3

Input:

CODE

{{ '195.168.100.35' | split('.') }}

Return Data:

JSON

[
  "195",
  "168",
  "100",
  "35"
]

EXAMPLE 3

Input:

CODE

{{ 'user1🌈user2🌈user3' | split('🌈') }}

Return Data:

JSON

[
  "user1",
  "user2",
  "user3"
]

start_with(compare_string)

Returns a Boolean value indicating whether the input string begins with the compare string.

Examples - start_with

EXAMPLE 1

Input:

CODE

{{ 'D3 Security Management Systems' | start_with('Security') }}

Return Data:

TEXT

False

EXAMPLE 2

Input:

CODE

{{ ['a','b'] | tojson | start_with('[') }}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{{ {'k':'v'} | tojson | start_with('{"k":') }}

Return Data:

TEXT

True

string

Returns a string representation of the piped input.

Examples - string

EXAMPLE 1

Input:

CODE

{{ false | check_type }}
{{ false | string | check_type }}
{{ 3 | check_type }}
{{ 3 | string | check_type }}

Return Data:

TEXT

bool
str
int
str

EXAMPLE 2

Input:

CODE

{{ {"a":"D3"} | base64_encode }}
{{ {"a":"D3"} | string | base64_encode }}
{{ "RDM=" | base64_decode }}
{{ "eydhJzogJ0QzJ30=" | base64_decode }}

Return Data:

TEXT

RDM=
eydhJzogJ0QzJ30=
D3
{'a': 'D3'}

EXAMPLE 3

Input:

CODE

{{ ["D","3"] }}
{{ ["D","3"] | string }}

Return Data:

JSON

['D', '3']
['D', '3']

EXAMPLE 4

Input:

CODE

{{ "3" | md5_hash }}
{{ {"D":"3"} | md5_hash }}
{{ "{'D': '3'}" | md5_hash }}
{{ {"D":"3"} | string | md5_hash }}

Return Data:

JSON

eccbc87e4b5ce2fe28308fd9f2a7baf3
eccbc87e4b5ce2fe28308fd9f2a7baf3
d6097d5062581ecc9c80cff7d9695eb9
d6097d5062581ecc9c80cff7d9695eb9

string_contains(compare_string)

Returns a Boolean value indicating whether the input contains the compare string.

Examples - string_contains

EXAMPLE 1

Input:

CODE

{{ 'D3 Security Management Systems' | string_contains('stem') }}

Return Data:

TEXT

True

EXAMPLE 2

Input:

CODE

{{ [1,2] | tojson | string_contains('3') }}

Return Data:

TEXT

False

EXAMPLE 3

Input:

CODE

{{ {'k':'v'} | tojson | string_contains('": "') }}

Return Data:

TEXT

True

Explanation: The tojson filter converts {'k':'v'} to {"k": "v"}.

string_not_contain(compare_string)

Returns a Boolean value indicating whether the input does not contain the compare string.

Examples - string_not_contain

EXAMPLE 1

Input:

CODE

{{ 'D3 Security Management Systems' | string_not_contain('stem') }}

Return Data:

TEXT

False

EXAMPLE 2

Input:

CODE

{{ [1,2] | tojson | string_not_contain('3') }}

Return Data:

TEXT

True

EXAMPLE 3

Input:

CODE

{{ {'k':'v'} | tojson | string_not_contain('": "') }}

Return Data:

TEXT

False

Explanation: The tojson filter converts {'k':'v'} to {"k": "v"}.

string_to_json_object(json_string)

Returns a JSON object parsed from the piped input.

Examples - string_to_json_object

EXAMPLE 1

Input:

CODE

{{ '{"k":"v"}' | string_to_json_object }}

Return Data:

JSON

{
  "k": "v"
}

EXAMPLE 2

Input:

CODE

{{ '[1,2]' | string_to_json_object }}

Return Data:

JSON

[
  1,
  2
]

EXAMPLE 3

Input:

CODE

{{ '{"a":[{"b":1},{"c":2}]}' | string_to_json_object }}

Return Data:

JSON

{
  "a": [
    {
      "b": 1
    },
    {
      "c": 2
    }
  ]
}

strip_newlines

Returns a string with all newline (\n) characters removed.

Examples - strip_newlines

EXAMPLE 1

Input:

CODE

{{ 'D3\nSecurity' | strip_newlines }}

Return Data:

TEXT

D3Security

EXAMPLE 2

Input:

CODE

{{ '\nD3\nSecurity\nManagement\nSystems' | strip_newlines }}

Return Data:

TEXT

D3SecurityManagementSystems

striptags

Returns a string with literal SGML and XML tags removed while preserving non-tag text, and collapses all adjacent whitespace characters into a single space.

Examples - striptags

EXAMPLE 1

Input:

CODE

{{ '<p>α</p>' | striptags }}

Return Data:

TEXT

α

EXAMPLE 2

Input:

CODE

{{ '<p>D3   Security</p>' | striptags }}

Return Data:

TEXT

D3 Security

EXAMPLE 3

Input:

CODE

{{ '<div><span>D3</span> Docs</div>' | striptags }}

Return Data:

TEXT

D3 Docs

EXAMPLE 4

Input:

CODE

{{ '[\"<p>a</p>\", \"<b>b</b>\"]' | striptags }}

Return Data:

JSON

[
  "a",
  "b"
]

EXAMPLE 5

Input:

CODE

{{ '["<p>c</p>", "<p>d</p>"]' | striptags }}

Return Data:

JSON

[
  "c",
  "d"
]

EXAMPLE 6

Input:

CODE

{{ '<p>&lt;D3&gt;</p>' | striptags }}

Return Data:

TEXT

<D3>

title

Returns a string with each word capitalized and remaining characters in lowercase.

CUSTOM TITLE CASE MACRO

See Macro for Title-Style Formatting to use or extend the custom macro for specific title case capitalization needs.

Examples - title

EXAMPLE 1

Input:

CODE

{{ 'd3 security' | title }}

Return Data:

TEXT

D3 Security

EXAMPLE 2

Input:

CODE

{{ 'd3 SECURITY management system' | title }}

Return Data:

TEXT

D3 Security Management System

Macro for Title-Style Formatting

Macro for Title-Style Formatting

CODE

{% macro title_case(text) %}
    {% set minor_words = ['a', 'an', 'the', 'and', 'but', 'or', 'nor', 'for', 'yet', 'so', 'as', 'if', 'than', 'though', 'although', 'at', 'by', 'down', 'from', 'in', 'into', 'like', 'near', 'of', 'off', 'on', 'onto', 'out', 'over', 'past', 'per', 'since', 'through', 'to', 'toward', 'towards', 'under', 'until', 'up', 'upon', 'via', 'with', 'within', 'without', 'vs'] %}
    {% set phrasal_map = {'log': ['in', 'out', 'on'], 'sign': ['in', 'out', 'up'], 'turn': ['off', 'on'], 'set': ['up'], 'shut': ['down'], 'back': ['up'], 'break': ['down'], 'check': ['in', 'out'], 'phase': ['out'], 'roll': ['out'], 'hand': ['off'], 'spin': ['up'], 'make': ['up'], 'take': ['over'], 'bring': ['up'], 'carry': ['on'], 'follow': ['up']} %}
    {% set lexical_units = {'real time': 'Real Time'} %}
    {% set brands = {'github': 'GitHub', 'youtube': 'YouTube', 'iphone': 'iPhone', 'ebay': 'eBay', 'macos': 'macOS', 'oauth': 'OAuth', 'ipv6': 'IPv6', '5g': '5G', 'nasa': 'NASA', 'out-of-band': 'Out-of-Band', 'follow-up': 'Follow-Up', 'log-on': 'Log-On', 'real-time': 'Real-Time', 'state-of-the-art': 'State-of-the-Art', 'up-to-date': 'Up-to-Date', 'once-in-a-lifetime': 'Once-in-a-Lifetime', 'make-up': 'Make-Up', 'walk-through': 'Walk-Through', 'nosql': 'NoSQL', 'ddos': 'DDoS', 'covid': 'COVID'} %}
    {% set acronyms = ['api', 'sql', 'ascii', 'nato', 'spa', 'tls', 'ssl', 'ml', 'ai', 'iam', 'pam', 'siem'] %}
    {% set clean = text | replace('\t', ' ') %}
    {% set raw = clean | split(' ') %}
    {% set ns = namespace(out = [], force_cap = True, len = raw | length) %}
    {% for i in range(ns.len) %}
        {% set word = raw[i] %}
        {% set lower = word | lower %}
        {% set prev = (raw[i-1] | lower) if i > 0 else '' %}
        {% set next = (raw[i+1] | lower) if i < ns.len - 1 else '' %}
        {% set lex_pair = lower ~ ' ' ~ next %}
        {% set is_phrasal = (prev in phrasal_map and lower in phrasal_map[prev]) %}
        {% set is_per_se = (lower == 'se' and prev == 'per') %}
        {% set treat_as_minor = ((lower in minor_words and not is_phrasal and i > 0 and i < ns.len - 1) or is_per_se) %}
        {% if lower in brands %}
            {% set final = brands[lower] %}
        {% else %}
            {% set safe = word | replace("'", "__AP__") %}
            {% set hparts = safe | split('-') %}
            {% set wn = namespace(segs = []) %}
            {% for h in hparts %}
                {% set h = h | replace("__AP__", "'") %}
                {% set sparts = h | split('/') %}
                {% set sp = namespace(segs = []) %}
                {% for s in sparts %}
                    {% set low = s | lower %}
                    {% set looks_acro = (s == s | upper and s | length > 1) or (low in acronyms) %}
                    {% if low in brands %}
                        {% set sp.segs = sp.segs + [brands[low]] %}
                    {% elif looks_acro %}
                        {% set sp.segs = sp.segs + [low | upper] %}
                    {% elif s != low %}
                        {% set sp.segs = sp.segs + [s] %}
                    {% else %}
                        {% set cap = (not treat_as_minor) or ns.force_cap or is_phrasal or i == 0 or i == ns.len - 1 %}
                        {% if cap %}
                            {% set sp.segs = sp.segs + [low | capitalize] %}
                        {% else %}
                            {% set sp.segs = sp.segs + [low] %}
                        {% endif %}
                    {% endif %}
                {% endfor %}
                {% set wn.segs = wn.segs + [sp.segs | join('/')] %}
            {% endfor %}
            {% set final = wn.segs | join('-') %}
        {% endif %}
        {% set ns.out = ns.out + [final] %}
        {% if word and word[-1] in [':', '.', '!', '?', ','] %}
            {% set ns.force_cap = True %}
        {% else %}
            {% set ns.force_cap = False %}
        {% endif %}
    {% endfor %}
    {% set joined = ns.out | join(' ') %}
    {% for k in lexical_units.keys() %}
        {% set joined = joined | replace(k, lexical_units[k]) %}
    {% endfor %}
    {{ joined }}
{% endmacro %}

EXAMPLE 1

Input:

CODE

{% set title1 = 'macro for title-style formatting' %}
{{ title_case(title1) }}

Return Data:

TEXT

Macro for Title-Style Formatting

EXAMPLE 2

Input:

CODE

{% set title2 = 'input/output operations' %}
{{ title_case(title2) }}

Return Data:

TEXT

Input/Output Operations

EXAMPLE 3

Input:

CODE

{% set title3 = 'once-in-a-lifetime event' %}
{{ title_case(title3) }}

Return Data:

TEXT

Once-in-a-Lifetime Event

EXAMPLE 4

Input:

CODE

{% set title4 = 'out-of-band workflows' %}
{{ title_case(title4) }}

Return Data:

TEXT

Out-of-Band Workflows

EXAMPLE 5

Input:

CODE

{% set title5 = 'the user\'s opt-in preferences' %}
{{ title_case(title5) }}

Return Data:

TEXT

The User's Opt-In Preferences

EXAMPLE 6

Input:

CODE

{% set title6 = 'anti-ddos protections' %}
{{ title_case(title6) }}

Return Data:

TEXT

Anti-DDoS Protections

EXAMPLE 7

Input:

CODE

{% set title7 = 'post-covid planning' %}
{{ title_case(title7) }}

Return Data:

TEXT

Post-COVID Planning

trim(character_type)

Returns a new string with the specified type of leading and trailing character stripped from the original value. By default, the filter removes whitespace.

Examples - trim

EXAMPLE 1

Input:

CODE

{{ "   D3   " | trim | replace(' ', '_') }}
{{ "   D3   " | replace(' ', '_') }}

Return Data:

TEXT

D3
___D3___

EXAMPLE 2

Input:

CODE

{{ "...ASOC..." | trim(".") }}

Return Data:

TEXT

ASOC

EXAMPLE 3

Input:

CODE

{{ "///Docs//" | trim("/") }}

Return Data:

TEXT

Docs

EXAMPLE 4

Input:

CODE

{{ 'D33' | trim('3') }}
{{ 'DD3' | trim('D') }}

Return Data:

TEXT

D
3

EXAMPLE 5

Input:

CODE

{{ {'k': '___v___'} | trim('_') }}

Return Data:

TEXT

EXAMPLE 6

Input:

CODE

{{ [ "~D3~", "~Security~" | trim("~"), "~Management~", "~Systems~"] }}

Return Data:

TEXT

[
  "~D3~",
  "Security",
  "~Management~",
  "~Systems~"
]

truncatewords(number_of_words, suffix)

Returns a shortened version of the string containing only the first specified number of words, using spaces as delimiters. Appends a suffix to the end of the string if the input length exceeds the limit. By default, the suffix is an ellipsis.

Examples - truncatewords

EXAMPLE 1

Input:

CODE

{{ "D3 Security Management" | truncatewords(2) }}

Return Data:

TEXT

D3 Security...

EXAMPLE 2

Input:

CODE

{{ "Error 404 Not Found" | truncatewords(1, ":") }}

Return Data:

TEXT

Error:

EXAMPLE 3

Input:

CODE

{{ "D3 Security" | truncatewords(42) }}

Return Data:

TEXT

D3 Security

EXAMPLE 4

Input:

CODE

{{ "Log\nTrace\nId" | truncatewords(2) }}

Return Data:

TEXT

Log
Trace
Id

EXAMPLE 5

Input:

CODE

{{ "ChatGPT Claude Gemini Grok" | truncatewords(1, "") }}

Return Data:

TEXT

ChatGPT

upper

Returns an uppercase representation of the piped input string.

Examples - upper

EXAMPLE 1

Input:

CODE

{{ 'utility command' | upper }}

Return Data:

TEXT

UTILITY COMMAND

EXAMPLE 2

Input:

CODE

{{ ['d3', 'security' | upper, 'management', 'systems'] }}

Return Data:

TEXT

['d3', 'SECURITY', 'management', 'systems']

EXAMPLE 3

Input:

CODE

{{ {'a':'report', 'b':'system' | upper} }}

Return Data:

TEXT

{'a': 'report', 'b': 'SYSTEM'}

url_decode

Returns a decoded representation of the encoded URL.

Examples - url_decode

EXAMPLE 1

Input:

CODE

{{ 'https%3A//d3security.com/integrations/microsoft/' | url_decode }}

Return Data:

TEXT

https://d3security.com/integrations/microsoft/

EXAMPLE 2

Input:

CODE

{{ {'url':'https%3A//demo.com/x/y%3Fu%3Da%26v%3D1%23z'} | url_decode }}

Return Data:

TEXT

https://demo.com/x/y?u=a&v=1#z

EXAMPLE 3

Input:

CODE

{% for u in ['https%3A//chatgpt.com/', 'https%3A//gemini.google.com/app'] -%}
    {{ u | url_decode }}
{% endfor %}

Return Data:

TEXT

https://chatgpt.com/
https://gemini.google.com/app

url_encode

Returns an encoded representation of the URL string by replacing special characters with their UTF-8 escape sequences.

Examples - url_encode

EXAMPLE 1

Input:

CODE

{{ 'https://d3security.com/integrations/microsoft/' | url_encode }}

Return Data:

TEXT

https%3A//d3security.com/integrations/microsoft/

EXAMPLE 2

Input:

CODE

{{ 'https://demo.com/x/y?u=a&v=1#z' | url_encode }}

Return Data:

TEXT

https%3A//demo.com/x/y%3Fu%3Da%26v%3D1%23z

EXAMPLE 3

Input:

CODE

{% for url in ['https://chatgpt.com/', 'https://gemini.google.com/app'] -%}
    {{ url | url_encode }}
{% endfor %}

Return Data:

TEXT

https%3A//chatgpt.com/
https%3A//gemini.google.com/app

urlize(trim_url_limit, nofollow, target, rel)

Returns HTML anchor tags for URLs that use the http, https, or mailto schemes, as well as bare domains, while preserving all surrounding text. Optional parameters enable trimmed link text and control link attributes.

Examples - urlize

EXAMPLE 1

Input:

CODE

{{ 'Visit https://docs.d3security.com/?contextKey=JinjaBasics&version=latest' 
  | urlize }}

Return Data:

TEXT

Visit <a href="https://docs.d3security.com/?contextKey=JinjaBasics&amp;version=latest" rel="noopener" target="_blank">https://docs.d3security.com/?contextKey=JinjaBasics&amp;version=latest</a>

EXAMPLE 2

Input:

CODE

{{ 'Visit https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&version=latest' 
  | urlize(target='_self') }}

target attribute values:

_blank: Opens the link in a new browser tab or window.
_self: Opens the link in the same tab or frame. This is the default behavior.
_parent: Opens the link in the immediate parent frame, if one exists.
_top: Opens the link in the full window, removing any frames.
framename: Opens the link inside a specific frame that matches the given name.

Return Data:

TEXT

Visit <a href="https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&amp;version=latest" rel="noopener" target="_self">https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&amp;version=latest</a>

EXAMPLE 3

Input:

CODE

{{ 'Visit https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&version=latest' 
  | urlize(27) }}

Explanation: The trim_url_limit parameter can be provided positionally without naming it.

Return Data:

TEXT

Visit <a href="https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&amp;version=latest" rel="noopener" target="_blank">https://docs.d3security.com...</a>

EXAMPLE 4

Input:

CODE

{{ 'Visit https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&version=latest' 
  | urlize(rel='external') }}

Common rel values:

external: Identifies that the linked resource resides outside the current site.
nofollow: Instructs search engines not to follow the link or assign ranking signals to the target.
noopener (auto-applied): Prevents the new browsing context from accessing the originating document by disabling the window.opener property. This reduces the risk of tab-nabbing attacks.
noreferrer: Prevents the browser from sending the referring page's URL to the target resource.
ugc: Indicates that the link originates from user-generated content.
sponsored: Marks the link as paid, sponsored, or promotional in nature.

Return Data:

TEXT

Visit <a href="https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&amp;version=latest" rel="external noopener" target="_blank">https://docs.d3security.com/user-docs/?contextKey=JinjaBasics&amp;version=latest</a>

wordcount

Returns the number of word-forming character sequences in the input string. How it works:

Counts alphanumeric or Unicode letter sequences as words.
Delimits text at whitespace, punctuation, and symbol characters, except underscores and unescaped backslashes.
- Treats underscores as part of a word
- Treats escaped backslashes as split points
Collapses consecutive delimiters into a single boundary.

Examples - wordcount

EXAMPLE 1

Input:

CODE

{{ 'Word1 word2   \t   word3' | wordcount }}

Return Data:

TEXT

EXAMPLE 2

Input:

CODE

{{ '中文 français español भाषा' | wordcount }}

Return Data:

TEXT

Explanation: Hindi vowel signs are technically marks, which the filter treats as spaces (effectively delimiters). This causes भाषा to be read as two separate words (भ and ष).

EXAMPLE 3

Input:

CODE

{{ 'x,y.z' | wordcount }}

Return Data:

TEXT

EXAMPLE 4

Input:

CODE

{{ 'a_b' | wordcount }}

Return Data:

TEXT

EXAMPLE 5

Input:

CODE

{{ '! @ # $ % ^ & * ( ) - + = ✏️' | wordcount }}

Return Data:

TEXT

wordwrap(maximum_line_width)

Returns the input string wrapped to a specified maximum line width. How it works:

Contiguous words exceeding the maximum line width are segmented.
Line breaks are enforced before any standard whitespace character if the following word would exceed the maximum line width.
Non-breaking characters are treated as part of the contiguous word.

Examples - wordwrap

EXAMPLE 1

Input:

CODE

{% set w = 'Word1 word2\t\r\nword3 word4 word5 word6 word7 word8 word9 word10.' %}
{{ w | wordwrap(5) }}

Return Data:

TEXT

Word1
word2
word3
word4
word5
word6
word7
word8
word9
word1
0.

EXAMPLE 2

Input:

CODE

{% set x = 'x1 x12 x123 x1234 x12345 x123456 x1234567 x12345678' %}
{{ x | wordwrap(9) }}

Return Data:

TEXT

EXAMPLE 3

Input:

CODE

{% set x = 'x1 x12 x123 x1234 x12345 x123456 x1234567 x12345678' %}
{{ x | wordwrap(10) }}

Return Data:

TEXT

EXAMPLE 4

Input:

CODE

{% set x = 'x1 \n x12 x123 x1234 x12345 x123456 x1234567 x12345678' %}
{{ x | wordwrap(10) }}

Return Data:

TEXT

EXAMPLE 5

Input:

CODE

{% set x = 'x12345 x123456' %}
{{ x | wordwrap(3) }}

Return Data:

TEXT

EXAMPLE 6

Input:

CODE

{% set x = 'x12345-x123456' %}
{{ x | wordwrap(10) }}

Return Data:

TEXT

x12345-x12
3456

FAQs

What are scalar values?

A scalar value is a single, atomic piece of data that cannot be expanded or decomposed into smaller structured components. The following are scalars in Jinja:

String (e.g., "D3")
Number (e.g., 1, 3.14)
Boolean (e.g., True, False)
None (e.g., none)

A dictionary key cannot be the first scalar value because Jinja overlooks keys and evaluates only dictionary values.

What is EML text?

EML text is the plain-text format of an email message that follows the Internet Message Format defined in RFC 5322.

What is an HTML entity?

An HTML entity is a safe text representation that begins with & and ends with ;.

EXAMPLES

& for &
< for <
> for >
" for "
' for '

What is an HMAC value?

The hash-based message authentication code (HMAC) value is a fixed-length cryptographic digest generated from a message and a shared secret key using algorithms like HMAC-SHA1 or HMAC-SHA256. It provides cryptographic assurance of integrity and authenticity by allowing any recipient with the same key to verify that the received message and its accompanying HMAC value match.

ALGORITHM COMPARISON

HMAC-SHA1 outputs exactly 40 hex characters.

16^40 = 2^160 unique possible hash outputs.

HMAC-SHA256 outputs exactly 64 hex characters.

16^64 = 2^256 unique possible hash outputs.
HMAC-SHA256 has 2^96 times more possible outputs than HMAC-SHA1.

What does escaping mean?

Escaping is the process of replacing a literal character with a safe or encoded representation to prevent it from performing its normal syntactic or structural function. The escaped representation removes a character's special behavior, while unescaping restores the original character and its normal behavior.

JSON string escaping

Escaped forms: \n, \", \\.
Unescaped results: newline, ", \.

HTML escaping

Escaped forms: <, >, &, ".
Unescaped results: <, >, &, ".

Unicode escaping

Escaped forms: \u002E, \u0041\u0049, \u5FC3.
Unescaped results: ., AI, 心.

UTF-8 byte escaping

Escaped forms (byte-level): \x2E, \x41\x49, \xE5\xBF\x83.
Unescaped results: ., AI, 心.

Escaping prevents characters from acting on the parser. For example, without escaping:

A newline inserts a line break.
A double-quote terminates a string literal.
A backslash begins an escape sequence.
A < introduces an HTML tag.

RELATED ARTICLES