Set

Set a value in context under the key you entered.

Source

var ec = {};
var value;
try {
    if (args.stringify === 'true' ) {
        if (typeof args.value === 'string') {
            value = args.value
        } else {
            value = JSON.stringify(args.value)
        }
    } else {
        if (!isNaN(args.value) && !args.value.includes('.') && Number(args.value) >= Number.MAX_SAFE_INTEGER) {
            value = BigInt(args.value);
        }
        else {
            value = JSON.parse(args.value);
        }
    }
} catch (err) {
    value = args.value;
}
ec[args.key] = value;
var result = {
    Type: entryTypes.note,
    Contents: ec,
    ContentsFormat: formats.json,
    HumanReadable: 'Key ' + args.key + ' set'
};

if (!args.append || args.append === 'false') {
    setContext(args.key, value);
} else {
    result.EntryContext = ec;
}
logDebug(`Setting ${JSON.stringify(result)}`)
return result;

README

Set a value in context under the key you entered.

Script Data

Name	Description
Script Type	javascript
Tags	Utility

Used In

Sample usage of this script can be found in the following playbooks and scripts.

Arcsight - Get events related to the Case
Detonate File - BitDam
Endace Search Archive Download PCAP v2
Illinois - Breach Notification
Illusive - Incident Escalation
Malware Investigation - Generic - Setup
QRadar - Get offense correlations v2
QRadar Indicator Hunting
SafeBreach - Create Incidents per Insight and Associate Indicators
Wait Until Datetime

Inputs

Argument Name	Description
key	The key to set. Can be a full path such as “Key.ID”. If using append=true can also use a DT selector such as “Data(val.ID == obj.ID)”.
value	The value to set to the key. Can be an array (e.g. [“192.168.1.1”,”192.168.1.2”]) or JSON (e.g. {“key”:”value”}).
append	If false then the context key will be overwritten. If set to true then the script will append to existing context key.
stringify	Whether the argument should be saved as a string.

Outputs

There are no outputs for this script.

Script Example

!Set key="Data(val.ID == obj.ID)" value=`{"ID": "test_id", "Value": "test_val2"}` append="true"

Context Example

{
    "Data": {
        "ID": "test_id",
        "Value": "test_val2"
    }
}

Human Readable Output

Key Data(val.ID == obj.ID) set

Known Limitations

The script has some limitations with appending to the context in different cases and formats:

The value argument can’t be larger than 25MB. In general, it is not recommended to ingest large data to context values.
When append is set to false - the script will not support dt operations given as part of the key argument.
When Set is called from within another script - if append is set tot true it is necessary to manually
return the results given by the demisto.executeCommand, for the context update to take place.
For example:
```
    res = execute_command('Set', {'append': 'true', 'key': 'MyKey', 'value': 'MyValue'})
  return_results(res)
```