
Hi Jon,
Thanks for reaching out to us, your query will be answered momentarily. In the meantime if theres anything else we can help with, do not hesitate to reach out.
I am taking the first steps with the SOAR capability in LP7.
I am trying to use the Nexpose API to enrich data of a device, and collect info like OS, number of vulnerabilities etc using the nexpose-search-assets Action, as this can filter on an IP address and doesn’t need the Nexpose device ID.
The filters are in the request body in JSON format.
The Logpoint action for this has the following in the request body (out of the box there are a couple of additional optional fields which I have removed as they are not needed for this).
{"filters": [{"field": "", "operator": "", "value": "",}, "match": "all"}
The field and operator can be hard coded for this action as they won’t change.
How do I configure the action so that when an IP address is passed into the action in a playbook, it gets inserted into the request body as the value?
Share This Post:
Hi Jon,
Thanks for reaching out to us, your query will be answered momentarily. In the meantime if theres anything else we can help with, do not hesitate to reach out.
Hi Jon,
In order to pass an IP address or any other parameter that you do not want to hard code, you can use ${parameter} in the request body. For example, for the nexpose-search-assets action, the request body can be {"filters": [{"field": "", "operator": "", "value": "${value}",}, "match": "all"}.
Make sure that you enter “field”, “operator”, “value” or any other parameter you would like to use in the “Request Params” under “General” section of the Configure Action panel. This might be missing in the default action that comes with LogPoint 7.
I hope this answered your question.
Hello Jon,
Adding to Priyanka’s Reply:
The $value in {"filters": [{"field": "", "operator": "", "value": "${value}",}, "match": "all"} takes the content of value placeholder box(i.e ip_place_holder in your case).
Additionally, you need to explicitly search and select the parameters to make it work ,i.e if you write ip_address_holder by your own in the value text box then it won’t work.
Please sign in to leave a comment.
3 comments