I’m not sure if this is a bug or intentional, however I am trying to loop thru the available “log_details” returned from calling the Rapid7 InsightIDR Solution - “Get Alert Information”. I noticed that after making the call to get the alert information, my “loop” variable does not present me the option to selection “log_details”. I can however select any other returned array from that function. I’ve attached some screen shots as well as my exported snippet if anyone is curious.
If you give me bit I can test it out. I have a few other things I am working on right now.
The other solution would be to open your the step that provides that information, and then hit the “edit json” button. This will allow you to change the variable output for that plugin. So under the alert section you can add in an array of objects called log_details. As long as you put it in the right spot in the hierarchy, and you spell it exactly as you see it, you can then pick it when choosing the loop.
If you want to create all the variables, it appears they are each a string. So Array of Objects called log_details then your object will contain the four variables below:
Question: By adding to the output of an OOTB plugin, when there is a future update to the plugin, what happens if there are output field changes? I guess I’ll find out as it would potentially be a “manual update” anyway
BTW: My not so elegant workaround originally was to basically create my own array artifact with the log_id and then cycle thru that to get the Get the logs.
Honestly that is why I love InsightConnect. A traditional tool a problem is a problem, and your choices for a workaround are slim to none.
While we don’t want to force you to use a workaround, it is nice once you have an understanding of InsightConnect, that you have almost a limitless number of alternate paths available to you.
If you were to update the plugin version, my guess as I as well do not know, it would erase your custom output. I am not sure if they didn’t create that variable because it doesn’t always exist, if it is a new addition to the api, not a 100% why it doesn’t exist. I will share with the team so they are aware of this.
