MapValuesTransformer

This script converts the input value into another value using two lists. The input value is searched in the first list (input_values). If it exists, the value from the second list (mapped_values) at the same index is retutrned. If there is no match, the original value is returned. If the original input is a dictionary, then the script will look for a "stringified" version of the key/:/value pair in the input_values and then map the result in the output_values into the original "value". Example 1: input_values = "1,2,3,4" mapper_values = "4,3,2,1" value = 3 Output would be "2" Example 2: input_values ="firstkey: datahere,secondkey: datathere" mapper_values = "datathere,datahere" value(dict)= { "firstkey": "datahere" } Output would be: { "firstkey": "datathere" } The reason for matching the key AND value pair in a dictionary is to allow the mappig of values that have a specific key name. In most cases, dictionaries will continan key-value pairs in which the values are the same. You might want to change the value of KeyA, but not the value of KeyB. This method gives control over which key is changed. When the input is a dict, str , int, or list, the output is ALWAYS returned as a string.

python · Filters And Transformers

Source

import json

import demistomock as demisto
from CommonServerPython import *

from CommonServerUserPython import *


def mapvalues(value, input_values, mapped_values):
    input_values = input_values.split(",")
    mapped_values = mapped_values.split(",")
    try:
        value = json.loads(value)
    except Exception:
        pass

    # Convert all to string
    value = str(value) if type(value) not in [dict, list] else value
    input_values[:] = [str(x) for x in input_values]
    mapped_values[:] = [str(x) for x in mapped_values]

    # If the provided input_value and mapper_values are not equal in length
    # then return an error

    if len(input_values) != len(mapped_values):
        return_error("Length of input_values and mapped_values are not the same")

    # Create a dictionary to look up values against
    mapper = {}
    for index in range(len(input_values)):
        mapper[input_values[index]] = mapped_values[index]

    # If the input is a dictionary then attempt to convert each
    # "key: value" as a string into the value in the mapper
    if type(value) is dict:
        new_dict = {}
        for k, v in value.items():
            key_value = f"{k}:{v}"
            key_value_space = f"{k}: {v}"
            if key_value in mapper:
                new_dict[k] = mapper[key_value]
            elif key_value_space in mapper:
                new_dict[k] = mapper[key_value_space]
            else:
                new_dict[k] = v
        value = json.dumps(new_dict)

    elif type(value) is list:
        for val in value:
            val = mapper.get(val, val)

    elif value in mapper:
        value = mapper[value]

    return value


def main():
    args = demisto.args()
    value = args.get("value")
    input_values = args.get("input_values")
    mapped_values = args.get("mapped_values")

    value = mapvalues(value, input_values, mapped_values)
    demisto.results(value)


if __name__ in ("__main__", "builtin", "builtins"):
    main()

README

MapValuesTransformer

This transformer script takes the input value and translates it based on two list arguments.

The script that takes two arguments:

input_values and mapped_values

Both arguments are comma-separated values. The total number of values for each input must be the same. For example:

input_values = "1,2,3,4"

mapped_values = "4,3,2,1"

If the length of each list is not the same, the script will error.

Example use 1

value = "3" (not specified by the user)

input_values = "1,2,3,4"

mapped_values = "4,3,2,1"

The resulting output would be “2”. The mapping looks up the value in the input_values and returns the value in
mapped_values at the same index.

Example use 2

value = {"testkey1": "testvalue1", "testkey2": "testvalue2"} (not specified by the user)

input_values = "key1: value1, testkey2: testvalue2"

mapped_values = "value1changed,testvalue2changed"

The resulting output would be {"key1": "value1", "key2": "testvalue2changed"}. Because the input_values can be
parsed as a JSON dictionary, it will match the key: value pair, but only alter the value in the pair.