Update Root Key Value for Trigger Output Data with JSON Path

This command can only be executed in the "On Event Ingestion" trigger within an event playbook. It inserts a new root key into the Trigger Output Data using the specified JSON Path.

Reader Note

Please note that this command is only applicable within an event Playbook.

Implementation	System
Command Category	System Utility
Tags	TRIGGER DATA

Inputs

Parameter Name	Required/Optional	Description	Sample Data
Source Type	Required	The data source from which data is obtained.	`Event Trigger Data`
JSON Path	Required	The JSON Path with a Root key name	`$.Data.newKey`
Update Value	Required	The trigger data value to be updated	CODE `{ "User": "Tom", "IPAddress": "13.64.156.22", "RiskLevel": "Medium" }`

Output

Remote Command API

The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.

Request

POST

CODE

https:/{base_url}/{api_namespace}/api/Command/UpdateRootKeyValueforTriggerOutputDatawithJSONPath

Headers

Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.

Request Body

JSON

{
  "Username": <Username here>,
  "Site": <Site here>,
  "CommandParams": {
    "Source Type": <Source Type here>, 
    "JSON Path": <JSON Path here>,
    "Update Value": <Update Value here>
  }
}

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`Text`	Optional	Option to share all tagged connection or just ones provided in connection info
Site	`Text`	Optional	Information about the connection to sync
Source Type	`Number`	Number	Number
JSON Path	`Text`	Number	Number
Update Value	`Text`	Number	Number

Sample Request

SAMPLE DATA

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Source Type": "Event Trigger Data",
    "JSON Path": "$.Data.newKey",
    "Update Value": {
      "User": "Tom",
      "IPAddress": "13.64.156.22",
      "RiskLevel": "Medium"
    }
  }
}

Response

Response Fields

Field Name	Type	Description
error	`text`	The error message if the API request has failed.
returnData	`JSON Object`	The return data from the API request.
contextData	`JSON Object`	The context data from the API request.

Sample Response

JSON

{
    "error": "",
    "returnData": {
    "result": {
            "success": true
        }
    },
    "rawData": "",
    "contextData": {
        "newKey": {
            "User": "Tom",
            "IPAddress": "13.64.156.22",
            "RiskLevel": "Medium"
        }
     }
}