How to do a loop of values inside an array without brackets and double quotes

InsightConnect Workflows
, , ,
1

Hi, I have a workflow that scans (md5) hashes on virustotal using the virustotal API.

So I made a loop and configured it so it would loop through a pre filtered list of hashes that I have extracted using regex from a string.

So like this:

image

Object output:

image

Everything till now works just fine, it succesfully scans the hashes but here is where my question comes.

I am trying to make an individual report of every scanned hash, so that means I have to write this in my artifact:

https://www.virustotal.com/gui/file/{{[“Filter Hashes”].[matches]}}/detection

OR

https://www.virustotal.com/gui/file/{{[“Loop hashes”].[$item]}}/detection

but both of those give me this as output:

https://www.virustotal.com/gui/file/[“c8bd2b28edbe71ae71153e14fb905dccc7de2ab2”]/detection

It adds the brackets and double quotes in the link, I am trying to do a regex to remove those brackets and quotes but unfortunely I am having no succes.

When you look at the second image I uploaded you can clearly see its not inside brackets and quotes there so if I typed https://www.virustotal.com/gui/file/{{[“Filter Hashes”].[matches].[0]}}/detection it would work. But then I somehow need to know how to keep incrementing that 0 inside the brackets.

I hope you guys have somewhat understood the question.
Thanks for reading

2

You can either do a loop on that array.
Or in an Artifact, you can also loop through

{{#each ["VirusTotal Enrichment"].[scans]}}
{{#if detected}}
{{@key}}:{{detected}}
{{/if}}
{{/each}}

{{#each ["VirusTotal Enrichment"].[scans]}}
*__{{@key}}:__ {{this}}
{{/each}}
3

But I am already doing a loop on that array.

Also I am not really familiar with the code you provided. Am I suppose to paste that somewhere? I am still fairly new to InsightConnect. Appreciate the answer :slight_smile:

4

you can do a loop in a loop.

The code is how to display the contents of a loop in an Artifact.
In this case it lists all the detections from VirusTotal in the Artifact Card

5

Yea what I was trying to say, if I loop on that array i still get the values with the brackets and quotes. So I dont know what I need to do

6

you can do an advanced regedit step to replace them

("|[|])

7

Can we go back to how you are extracting hashes from the string? It appears however you are doing this its giving you an Array of Arrays of which there is only one item.

In its current state to get what you need I believe your syntax needs to look like the example below. You are essentially saying "give me the first (0 is first) item in the array.

https://www.virustotal.com/gui/file/{{[“Loop hashes”].[$item].[0]}}/detection

A cleaner way to do this would probably be to use the Extractit plugin to pull an array of strings for you to loop over instead.

1 Like
8

Wow, this seem to did the trick. Thank you so much.