jmespath

Details

ID	`jmespath`
Language	python
From Version	5.0.0
Docker Image	`demisto/py3-tools:1.0.0.11597437`
Tags	transformer general

README

Performs a JMESPath search on an input JSON format, when using a transformer.

Script Data

Name	Description
Script Type	python3
Tags	transformer, general
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
expression	JMESPath expression
value	Original input value

Outputs

There are no outputs for this script.

Source

Jmespath.py Jmespath_test.py Jmespath.yml

Download History Raw

import json

import demistomock as demisto
from Jmespath import jmespath_search, main


def test_search():
    expression = "AutoFocus.IP[?IndicatorType=='IPV4_ADDRESS'].{Value: IndicatorValue, Type: IndicatorType}"
    value = {
        "AutoFocus": {
            "IP": [
                {
                    "IndicatorType": "IPV4_ADDRESS",
                    "IndicatorValue": "1.1.1.1",
                },
                {
                    "IndicatorType": "IPV4_ADDRESS",
                    "IndicatorValue": "2.2.2.2",
                },
            ]
        }
    }
    result = jmespath_search(expression, value)
    assert result == [{"Value": "1.1.1.1", "Type": "IPV4_ADDRESS"}, {"Value": "2.2.2.2", "Type": "IPV4_ADDRESS"}]


def test_search_string(mocker):
    expression = "AutoFocus.IP[?IndicatorType=='IPV4_ADDRESS'].{Value: IndicatorValue, Type: IndicatorType}"
    value = json.dumps(
        {
            "AutoFocus": {
                "IP": [
                    {
                        "IndicatorType": "IPV4_ADDRESS",
                        "IndicatorValue": "1.1.1.1",
                    },
                    {
                        "IndicatorType": "IPV4_ADDRESS",
                        "IndicatorValue": "2.2.2.2",
                    },
                ]
            }
        }
    )
    mocker.patch.object(demisto, "args", return_value={"value": value, "expression": expression})
    mocker.patch.object(demisto, "results")
    main()
    res = demisto.results.call_args[0][0]
    assert res == ([{"Value": "1.1.1.1", "Type": "IPV4_ADDRESS"}, {"Value": "2.2.2.2", "Type": "IPV4_ADDRESS"}])