Hello
I'm trying to pass a list of dicts from a "custom code block" into a "filter block", to run either ip_lookup, hash_lookup, or both sub-playbooks based on the indicator type.
For example:
ioc_list =
Expected output:
filtered-data on condition_1 route:
filtered-data on condition_2 route:
@glc_slash_it custom functions don't pass out information in the same way an action would via action_results. You can't filter on CF outputs in the same way unfortunately.
Either;
1. Do the filtering in the CF and pass out only what you need.
2. Use another Code Block to do the additional understanding and pass out a list.
3. Convert your function to an app action to take advantage of the action_results capability then you can split them with filters/decisions.
-- I Hope this helped, if so please mark as a solution for others asking the same question! Happy SOARing! --
Hi @phanTom thanks for the suggestions, they help!
@glc_slash_it custom functions don't pass out information in the same way an action would via action_results. You can't filter on CF outputs in the same way unfortunately.
Either;
1. Do the filtering in the CF and pass out only what you need.
2. Use another Code Block to do the additional understanding and pass out a list.
3. Convert your function to an app action to take advantage of the action_results capability then you can split them with filters/decisions.
-- I Hope this helped, if so please mark as a solution for others asking the same question! Happy SOARing! --