AnyMatch
Returns all elements from the left side that have a substring that is equal to an element from the right side. Note: This filter is case-insensitive. E.g -AnyMatch left=baby right=A will return baby. For more examples see the filter's Readme.
- Type
- python
- Pack
- FiltersAndTransformers
Source
import demistomock as demisto # noqa: F401
from CommonServerPython import * # noqa: F401
def is_substring_in_list(single_str: str, str_list: list[str]) -> bool:
"""
This function checks if a string is in a list of strings, fully or partially, case insensitive.
Args:
single_str: A string to check if it exists in the list.
str_list: A list of strings to check if the single_str is in it, fully or partially.
Returns:
True or False
"""
lower_list = [x.lower() for x in str_list]
return any(i in single_str.lower() for i in lower_list)
def main():
args = demisto.args()
leftArg = args.get("left")
rightArg = args.get("right")
left_list = argToList(str(leftArg)) if leftArg else []
right_list = argToList(str(rightArg))
if left_list:
for left_val in left_list:
return_results(is_substring_in_list(left_val, right_list))
else:
return_results(False)
if __name__ in ("__main__", "__builtin__", "builtins"):
main()
README
This filter accepts two inputs, left and right, each of which can be either a single element of any type (e.g., string, int, etc.) or a list of elements. The filter iterates over each element in the left input and returns all elements that have a substring that is equal to an element from the right side. The matching process is case-insensitive, meaning it disregards letter case during the comparison.
All inputs are treated either as a string or as a list of strings, if it contains a comma.
A JSON is always treated as a string.
Since the comparison treats all inputs as strings, integers and strings are considered equal during the evaluation.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | filter |
| Cortex XSOAR Version | 6.9.0 |
Inputs
| Argument Name | Description |
|---|---|
| left | Value to check if it has a substring that is equal to an element in the right side. Can be a single value or a comma-separated list. |
| right | Value to check if it is equal to an element or to a substring of an element from the left. Can be a single value or a comma-separated list. |
Outputs
There are no outputs for this script.
Table of examples
| Left | Right | Result | Explanation |
|---|---|---|---|
| 1,2,3 | “1” | 1 | Integers are treated as strings. |
| 1,2,250 | 25,10 | 250 | A part of 250 exists in the right side. |
| 1 | 21 | None | |
| 5,1,6,9,65,8 | 1,6 | 1,6,65 | |
| a | holla | None | |
| bca | A | bca | The filter is case-insensitive. |
| {‘alert’ {‘data’: ‘x’}} | x | {‘alert’ {‘data’: ‘x’}} | |
| {‘a’:1},{‘b’:2} | {‘a’:1,’c’:2} | None | {'a':1,'c':2} is nat a part of a value from the left. |
| {‘a’:1},{‘b’:2} | {a:1} | None | {a:1} is not a part of any value from the left. |
| {key1:value1, key2:value2} | 1 | {key1:value1, key2:value2} | A json is treated as a single string, even when there is a comma in it. |
| ’’,’ | {‘a’:1,’c’:2} | ’ | '' is not a part of {'a':1,'c':2}, but ' is. |