Currently, in an InsightConnect snippet I’m creating in order to pull device agent data from multiple sources (i.e., MS Defender for Endpoint and Rapid7 IVM). From that snippet, I output objects for each device agent. Then, I pass those objects to a Teams “Send HTML Message” for output, and am attempting to format values from those objects into the HTML.
Example format:
{{["Snippet"].[R7 Agent].[agent].[id]}}
Error received:
There was 1 step issue.
Step: 'Post Results HTML ’ has the following error:
we can’t find a snippet output variable called ‘R7 Agent.agent.id’
But, when using just the snippet object returned and none of the values inside it like so:
{{["Snippet"].[R7 Agent]}}
The workflow will save with no errors or other complaints, and jobs for the workflow will complete successfully. I imagine that the issue is just something about the scope of the variable being passed through the snippet, but wanted to know if there is anything I’m doing wrong or any workarounds that can allow me to port that object over to my output from the snippet efficiently so I don’t have to reuse the steps in that snippet for multiple workflows.
Without seeing more information / screenshots from the snippet, I’d guess that the problem is with the variable you are using {{["Snippet"].[R7 Agent].[agent].[id]}} as I would have expected to see (") around “R7 Agent” like so {{["Snippet"].["R7 Agent"].[agent].[id]}}.
Have you tried to use the + button to select the field you are attempting to post to see how it is inserted into the HTML message box?
Snippets require you to create output using the “configure” button when in the snippet builder.
When you choose your Snippet step in your workflow you are asked to give it a name. That name will then give an object like every other step, but that object doesn’t contain any data about the actual execution occurring in the snippet. If I send it to a Teams Message as seen below, you can see that is not SentinelOne Agent Details.
For snippet output you have to define each variable you would want to use outside the workflow as individual variables. You can’t just send the entire object and still make use of the variables.
I would recommend pulling your send to Teams step inside of the Snippet.
Define the thread ID of the teams message sent as output in the snippet, and if you want additional details to also be sent outside of the snippet from the workflow, you can respond to the thread instead of having two net new messages from a single job execution.
If you Snippet is the last message being sent, then it would not need thread id defined as output, rather you would define thread ID as input, and then pass the message id from your first step in your workflow into your snippet ensuring all your messages are kept together.
If you wanted to use the . notation to call out the json instead of defining all the individual variables you can output the entire object as a string, so only one snippet out, and then use the type converter plugin in your workflow. Pass that object to Type Converter, use string to object and it will make your output useable.
You could then call out individual variables.
{{[“String To Object”].[output].[agent].[accountName]}}
The input building through the + button does show that the second field is not wrapped in quotation marks. No worries though as Darrick’s following explanation/suggestion got me all set.
Your explanation on your first post made perfect sense, and it’s essentially what I expected was happening but didn’t think to check that snippet output and verify the step data didn’t actually include the object information I was attempting to source through dot notation.
As for your follow-up that suggestion works perfectly and is exactly what I was looking for as a viable workaround to pass that object along outside the snippet scope.
