Update Root Key Value for Trigger Output Data with JSON Path
This command can only be executed in the "On Event Ingestion" trigger within an event playbook. It inserts a new root key into the Trigger Output Data using the specified JSON Path.
Reader Note
Please note that this command is only applicable within an event Playbook.
Implementation | System |
Command Category | System Utility |
Tags | TRIGGER DATA |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Source Type | Required | The data source from which data is obtained. |
|
JSON Path | Required | The JSON Path with a Root key name |
|
Update Value | Required | The trigger data value to be updated |
CODE
|
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/UpdateRootKeyValueforTriggerOutputDatawithJSONPath
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": <Username here>,
"Site": <Site here>,
"CommandParams": {
"Source Type": <Source Type here>,
"JSON Path": <JSON Path here>,
"Update Value": <Update Value here>
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Optional | Option to share all tagged connection or just ones provided in connection info |
Site |
| Optional | Information about the connection to sync |
Source Type |
| Number | Number |
JSON Path |
| Number | Number |
Update Value |
| Number | Number |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Source Type": "Event Trigger Data",
"JSON Path": "$.Data.newKey",
"Update Value": {
"User": "Tom",
"IPAddress": "13.64.156.22",
"RiskLevel": "Medium"
}
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"returnData": {
"result": {
"success": true
}
},
"rawData": "",
"contextData": {
"newKey": {
"User": "Tom",
"IPAddress": "13.64.156.22",
"RiskLevel": "Medium"
}
}
}