AnyMatch
Returns all elements from the left side that have a substring that is equal to an element from the right side. Note: This filter is case-insensitive. E.g -AnyMatch left=baby right=A will return baby. For more examples see the filter's Readme.
python · Filters And Transformers
Source
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def is_substring_in_list(single_str: str, str_list: list[str]) -> bool: """ This function checks if a string is in a list of strings, fully or partially, case insensitive. Args: single_str: A string to check if it exists in the list. str_list: A list of strings to check if the single_str is in it, fully or partially. Returns: True or False """ lower_list = [x.lower() for x in str_list] return any(i in single_str.lower() for i in lower_list) def main(): args = demisto.args() leftArg = args.get("left") rightArg = args.get("right") left_list = argToList(str(leftArg)) if leftArg else [] right_list = argToList(str(rightArg)) if left_list: for left_val in left_list: return_results(is_substring_in_list(left_val, right_list)) else: return_results(False) if __name__ in ("__main__", "__builtin__", "builtins"): main()
README
This filter accepts two inputs, left and right, each of which can be either a single element of any type (e.g., string, int, etc.) or a list of elements. The filter iterates over each element in the left input and returns all elements that have a substring that is equal to an element from the right side. The matching process is case-insensitive, meaning it disregards letter case during the comparison.
All inputs are treated either as a string or as a list of strings, if it contains a comma.
A JSON is always treated as a string.
Since the comparison treats all inputs as strings, integers and strings are considered equal during the evaluation.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | filter |
| Cortex XSOAR Version | 6.9.0 |
Inputs
| Argument Name | Description |
|---|---|
| left | Value to check if it has a substring that is equal to an element in the right side. Can be a single value or a comma-separated list. |
| right | Value to check if it is equal to an element or to a substring of an element from the left. Can be a single value or a comma-separated list. |
Outputs
There are no outputs for this script.
Table of examples
| Left | Right | Result | Explanation |
|---|---|---|---|
| 1,2,3 | “1” | 1 | Integers are treated as strings. |
| 1,2,250 | 25,10 | 250 | A part of 250 exists in the right side. |
| 1 | 21 | None | |
| 5,1,6,9,65,8 | 1,6 | 1,6,65 | |
| a | holla | None | |
| bca | A | bca | The filter is case-insensitive. |
| {‘alert’ {‘data’: ‘x’}} | x | {‘alert’ {‘data’: ‘x’}} | |
| {‘a’:1},{‘b’:2} | {‘a’:1,’c’:2} | None | {'a':1,'c':2} is nat a part of a value from the left. |
| {‘a’:1},{‘b’:2} | {a:1} | None | {a:1} is not a part of any value from the left. |
| {key1:value1, key2:value2} | 1 | {key1:value1, key2:value2} | A json is treated as a single string, even when there is a comma in it. |
| ’’,’ | {‘a’:1,’c’:2} | ’ | '' is not a part of {'a':1,'c':2}, but ' is. |