Best way to extract values from Array?

InsightConnect
1

I’m trying to build a workflow where I can block URLs and Domains from a Teams Message and I would like to be able to comments with the block request. Ideally, we would format the message so that when we block something in teams it looks like “[trigger] [url/domain] [comments]”.

I need a way to extract the comments from the message and not include the trigger or url.

I tried using the [trigger].[message].[words].[2:] variable since that’s the way to slice arrays in Python, however, that variable doesn’t return anything or appear to be valid.

I’ve also tried using a loop, but I can’t figure out how to set the starting point of the Loop to the value after the URL or use the output to only include iterations after the 2nd one.

The comments can contain multiple words so I’m at a loss of how to extract those comments from the words array but not include the first 2 words of the array.

Any help would be appreciated.

3

You can use RegEx and a pattern-match step. If you command string is something like !block-url www.rapid7.com Comment: Blocked by Michael C. This regex should work .* comment:\S*{{comment:/.*/}}

This would create an output variable named comment that you could then use where you need in your workflow.

4

I have my comments in quotes, so
!Command <URL/Domain> "<Note>"

Then
{{Note:/".+"/}}
then Advanced Regex to remove the quotes.

Also, Like @Michael-Cochran-Rapid7 suggested you could also use named parameters and do
-Comment "{{comment:/.+/}}"
or
comment:"{{comment:/.+/}}"
in a parsing step