Add Fields in Trigger Output Data
This command can only be executed within the "On Event Ingestion" trigger of an event playbook. It adds new fields to "row" and "col" within "UserMappedFields" and "Fields" of the Trigger Output Data.
Reader Note
Please note that this command is only applicable within an event Playbook.
Implementation | System |
Command Category | System Utility |
Tags | TRIGGER DATA |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Source Type | Optional | The data source from which data is being extracted. |
|
JSON Object | Optional | Key and Values to be added into Trigger Output Data |
CODE
|
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https://{base_url}/{api_namespace}/api/Command/addEventFieldData
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": <Username here>,
"Site": <Site here>,
"CommandParams": {
"Source Type": <Source Type here>,
"JSON Object": <The JSON object contains fields and data here>
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Source Type |
| Optional | The data source from which data is being extracted. |
JSON Object |
| Optional | Tactics to set to the specified events |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Source Type": "Trigger Output Data",
"JSON Object": {
"sample Key": "sampleValue",
"Event Type": "testType"
}
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
Sample Response
{
"error": "",
"returnData": "Successful",
"returnData": "{
"Fields": [
{
"FieldValue": "sampleValue",
"FieldName": "sample_Key",
"FieldDisplayName": "sample Key",
"FieldDistinctValue": null
},
{
"FieldValue": "testType",
"FieldName": "EventType",
"FieldDisplayName": "Event Type",
"FieldDistinctValue": "testType"
}
],
"UserMappedFields": {
"row": [
{
"fieldName": "sample_Key",
"value": "sampleValue",
"displayName": "sample Key"
},
{
"fieldName": "EventType",
"value": "testType",
"displayName": "Event Type"
}
],
"col": {
"sample_Key": "sampleValue",
"EventType": "testType"
}
}
}"
}