Pack Contributors:
- Samuel Kamar
- Masahiko Inoue
- Jaden Evanger
- Mandar Naik
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
Frequently used filters and transformers pack.
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
Name | Description |
---|---|
WhereFieldEquals | Return all items from the list where their given 'field' attribute is equal to 'equalTo' argument E.g. !WhereFieldEquals with the following arguments:
Will return all items names where field 'type' equals 'IP' - ['192.1,0.82', '172.0.0.2']. |
Cut | Cut a string by delimiter and return specific fields. Exampleinput: "A-B-C-D-E" return: "A-E". |
MergeDictArray | Each entry in an array is merged into the existing array if the keyed-value matches. |
Base64Decode | Decodes an input in Base64 format. |
GetValuesOfMultipleFields | The script receives a list of fields and a context key base path. For example, Key=Test.result List=username,user gets all of the values from Test.result.username and Test.result.user. |
ExtractInbetween | Extract a string from an existing string. |
If-Then-Else | A transformer for simple if-then-else logic. |
ModifyDateTime | Takes a date or time input and adds or subtracts a determined amount of time. Returns a string in date or time in ISO Format. |
JsonToTable | Accepts a json object and returns a markdown. Supports clickable links. |
FirstArrayElement | Returns the first element of an array. If the value passed is not an array, it returns the original value that was passed. |
IsInCidrRanges | Determines whether an IPv4 or IPv6 address is contained in at least one of the comma-delimited CIDR ranges. Multiple IPv4/IPv6 addresses can be passed comma-delimited and each will be tested. A mix of IPv4 and IPv6 addresses will always return false. |
RemoveNullBytes | Removes null bytes from string. |
IgnoreFieldsFromJson | Removed selected fields from the JSON object. |
CIDRBiggerThanPrefix | Checks whether a given CIDR prefix is bigger than the defined maximum prefix. |
URLEncode | Encodes a URL string by replacing special characters in the string using the %xx escape. For example: https://example.com converts to https:%2F%2Fexample.com. |
AnyMatch | Returns all elements from the left side that have a substring that is equal to an element from the right side. Note: This filter is case-insensitive. |
EmailDomainBlacklist | Accepts an array of domains as a block list, and a list of email addresses. The script then filters out any email address whose domain is in the block list. The filtered list will be returned as an array. |
RemoveMatches | Removes items from the given list of values if they match any of the patterns in the provided |
AfterRelativeDate | Checks the given datetime has occured after the provided relative time. |
FormatTemplate | Build text from a template that can include DT expressions. |
ConvertAllExcept | Convert all chosen values but exceptions. |
jmespath | Performs a JMESPath search on an input JSON format, when using a transformer. |
StringToArray | Converts string to array. |
URLDecode | Converts |
CheckIfSubdomain | Checks whether a given domain is a subdomain of one of the listed domains. |
PadZeros | Adds zeros (0) to the beginning of the string, until the string reaches the specified length. |
DateStringToISOFormat | This is a thin wrapper around the |
DedupBy | This transformer will remove elements of the array that contain an identical combination of values for the keys given. |
EmailDomainWhitelist | Accepts an array of domains as an allow list, and a list of email addresses. The script then filters out any email address whose domain is not in the allow list. The filtered list will be returned as an array. |
RegexGroups | Extraction of elements which are contained in all the subgroups of the match to the pattern. |
TimeStampToDate | Converts UNIX Epoch time stamp to a simplified extended ISO format string. Use it to convert time stamp to Demisto date field e.g. 1525006939 will return '2018-04-29T13:02:19.000Z' |
ParseJSON | Parse a given JSON string "value" to a representative object. Example: '{"a": "value"}' => {"a": "value"}. |
IPv4Whitelist | Transformer that returns a filtered list of IPv4 addresses, based on whether they match a comma-separated list of IPv4 ranges. Useful for filtering in internal IP address space. |
SumList | Sums a List This is an example for number transformer. |
MakePair | This transformer will create a list of dictionary by aggregating elements from two arrays. |
MapRangeValues | This script converts an input value into another value using two lists. The input value or range is searched in the first list (map_from). Example 1: map_from = "1,2,3,4" Output is "2" Example 2: map_from = "1-3,4" Output is "5". |
If-Elif | A transformer for if-elif-else logic. |
ConvertKeysToTableFieldFormat | Convert object keys to match table keys. |
ParseHTMLTables | Find tables inside HTML and extract the contents into objects using the following logic:
|
FormattedDateToEpoch | Converts a custom-formatted timestamp to UNIX epoch time. Use it to convert custom time stamps to a XSOAR date field. If you pass formatter argument, we will use it to transform. If not, we will use dateparser.parse for transforming. For more info, see: https://docs.python.org/3.7/library/datetime.html#strftime-and-strptime-behavior |
MapValuesTransformer | This script converts the input value into another value using two lists. The input value is searched in the first list (input_values). Example 1: input_values = "1,2,3,4" Output would be "2" Example 2: input_values ="firstkey: datahere,secondkey: datathere" Output would be: The reason for matching the key AND value pair in a dictionary is to allow the mappig of values that have a specific key name. In most cases, dictionaries will continan key-value pairs in which the values are the same. You might want to change the value of KeyA, but not the value of KeyB. This method gives control over which key is changed. When the input is a dict, str , int, or list, the output is ALWAYS returned as a string. |
AppendIfNotEmpty | Append item(s) to the end of the list if they are not empty. |
InRange | checks if left side is in range of right side (from,to anotation) |
LastArrayElement | Returns the last element of an array. If the value passed is not an array, it returns the original value that was passed. |
IsNotInCidrRanges | Checks whether an IPv4 or IPv6 address is not contained in one or more comma-delimited CIDR ranges. |
GetRange | Gets specified indexes of a list. |
RemoveEmpty | Remove empty items, entries or nodes from the array. |
JoinIfSingleElementOnly | Return the single element in case the array has only 1 element in it, otherwise return the whole array. |
ConvertToSingleElementArray | Converts a single string to an array of that string. |
ReverseList | Reverse a list This is an example for entire-list transformer - it operates the argument as a list (note the "entirelist" tag). |
ExtractEmailTransformer | Extracts email addresses from the given value. |
RegexReplace | Format patterns matched with regex. If the regex does not match any pattern, the original value is returned. Example 1: Example 2: |
DT | This automation allows the usage of DT scripts within playbooks transformers. |
ProductJoin | Returns the product of two lists, joined by a separator, as a list of strings. |
RegexExtractAll | Extraction of all matches from a specified regular expression pattern from a provided string. Returns an array of results. This differs from RegexGroups in several ways:
|
StringifyArray | Return the string encoded with JSON from the whole array |
StringContainsArray | Checks whether a substring or an array of substrings is within a string array(each item will be checked). Supports single strings as well. For example, for substrings ['a','b','c'] in a string 'a' the script will return true. |
GreaterCidrNumAddresses | Check if number of availble addresses in IPv4 or IPv6 CIDR is greater than given number. |
RegexExpand | Extract the strings matched to the patterns by doing backslash substitution on the template string. |
IPv4Blacklist | Transformer that returns a filtered list of IPv4 addresses, based on whether they do not match a comma-separated list of IPv4 ranges. Useful for filtering out internal IP address space. |
BetweenHours | Checks whether the given value is within the specified time (hour) range. |
LowerCidrNumAddresses | Check if number of availble addresses in IPv4 CIDR is lower than given number. |
MapPattern | This transformer will take in a value and transform it based on multiple condition expressions (wildcard, regex, etc) defined in a JSON dictionary structure. The key:value pair of the JSON dictionary should be: "condition expression": "desired outcome" For example: { The transformer will return the value matched to a pattern following to the priority. |
SortBy | This transformer will sort an array of dictionary values by keys in ascending or descending order. |
TimeComponents | Takes a date or time input and get time components in a specific time zone.
|
ConcatFormat | Returns a string concatenated with given a prefix and suffix which supports DT expressions. |
SetIfEmpty | Checks an object for an empty value and returns a pre-set default value. |
StripChars | Strip set of characters from prefix and/or suffix |
IsRFC1918Address | A filter that receives a single IPv4 address string as an input and determines whether it is in the private RFC-1918 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). For more information, see https://en.wikipedia.org/wiki/Private_network |
BetweenDates | Whether value is within a date range. |
Name | Description |
---|---|
EmailDomainBlacklist | Accepts an array of domains as a block list, and a list of email addresses. The script then filters out any email address whose domain is in the block list. The filtered list will be returned as an array. |
AnyMatch | Returns all elements from the left side that have a substring that is equal to an element from the right side. Note: This filter is case-insensitive. |
ReverseList | Reverse a list This is an example for entire-list transformer - it operates the argument as a list (note the "entirelist" tag). |
SumList | Sums a List This is an example for number transformer. |
DT | This automation allows the usage of DT scripts within playbooks transformers. |
PadZeros | Adds zeros (0) to the beginning of the string, until the string reaches the specified length. |
ParseJSON | Parse a given JSON string "value" to a representative object. Example: '{"a": "value"}' => {"a": "value"}. |
StringContainsArray | Checks whether a substring or an array of substrings is within a string array(each item will be checked). Supports single strings as well. For example, for substrings ['a','b','c'] in a string 'a' the script will return true. |
TimeComponents | Takes a date or time input and get time components in a specific time zone.
|
LastArrayElement | Returns the last element of an array. If the value passed is not an array, it returns the original value that was passed. |
CheckIfSubdomain | Checks whether a given domain is a subdomain of one of the listed domains. |
MakePair | This transformer will create a list of dictionary by aggregating elements from two arrays. |
InRange | checks if left side is in range of right side (from,to anotation) |
IsInCidrRanges | Determines whether an IPv4 or IPv6 address is contained in at least one of the comma-delimited CIDR ranges. Multiple IPv4/IPv6 addresses can be passed comma-delimited and each will be tested. A mix of IPv4 and IPv6 addresses will always return false. |
RegexExpand | Extract the strings matched to the patterns by doing backslash substitution on the template string. |
FormatTemplate | Build text from a template that can include DT expressions. |
MapValuesTransformer | This script converts the input value into another value using two lists. The input value is searched in the first list (input_values). Example 1: input_values = "1,2,3,4" Output would be "2" Example 2: input_values ="firstkey: datahere,secondkey: datathere" Output would be: The reason for matching the key AND value pair in a dictionary is to allow the mappig of values that have a specific key name. In most cases, dictionaries will continan key-value pairs in which the values are the same. You might want to change the value of KeyA, but not the value of KeyB. This method gives control over which key is changed. When the input is a dict, str , int, or list, the output is ALWAYS returned as a string. |
ParseHTMLTables | Find tables inside HTML and extract the contents into objects using the following logic:
|
GreaterCidrNumAddresses | Check if number of availble addresses in IPv4 or IPv6 CIDR is greater than given number. |
FormattedDateToEpoch | Converts a custom-formatted timestamp to UNIX epoch time. Use it to convert custom time stamps to a XSOAR date field. If you pass formatter argument, we will use it to transform. If not, we will use dateparser.parse for transforming. For more info, see: https://docs.python.org/3.7/library/datetime.html#strftime-and-strptime-behavior |
RemoveNullBytes | Removes null bytes from string. |
RegexGroups | Extraction of elements which are contained in all the subgroups of the match to the pattern. |
ConcatFormat | Returns a string concatenated with given a prefix and suffix which supports DT expressions. |
IgnoreFieldsFromJson | Removed selected fields from the JSON object. |
CIDRBiggerThanPrefix | Checks whether a given CIDR prefix is bigger than the defined maximum prefix. |
IsNotInCidrRanges | Checks whether an IPv4 or IPv6 address is not contained in one or more comma-delimited CIDR ranges. |
AppendIfNotEmpty | Append item(s) to the end of the list if they are not empty. |
MapPattern | This transformer will take in a value and transform it based on multiple condition expressions (wildcard, regex, etc) defined in a JSON dictionary structure. The key:value pair of the JSON dictionary should be: "condition expression": "desired outcome" For example: { The transformer will return the value matched to a pattern following to the priority. |
ExtractEmailTransformer | Extracts email addresses from the given value. |
TimeStampToDate | Converts UNIX Epoch time stamp to a simplified extended ISO format string. Use it to convert time stamp to Demisto date field e.g. 1525006939 will return '2018-04-29T13:02:19.000Z' |
StripChars | Strip set of characters from prefix and/or suffix |
If-Elif | A transformer for if-elif-else logic. |
ConvertAllExcept | Convert all chosen values but exceptions. |
JoinIfSingleElementOnly | Return the single element in case the array has only 1 element in it, otherwise return the whole array. |
ConvertToSingleElementArray | Converts a single string to an array of that string. |
GetValuesOfMultipleFields | The script receives a list of fields and a context key base path. For example, Key=Test.result List=username,user gets all of the values from Test.result.username and Test.result.user. |
ModifyDateTime | Takes a date or time input and adds or subtracts a determined amount of time. Returns a string in date or time in ISO Format. |
EmailDomainWhitelist | Accepts an array of domains as an allow list, and a list of email addresses. The script then filters out any email address whose domain is not in the allow list. The filtered list will be returned as an array. |
WhereFieldEquals | Return all items from the list where their given 'field' attribute is equal to 'equalTo' argument E.g. !WhereFieldEquals with the following arguments:
Will return all items names where field 'type' equals 'IP' - ['192.1,0.82', '172.0.0.2']. |
LowerCidrNumAddresses | Check if number of availble addresses in IPv4 CIDR is lower than given number. |
jmespath | Performs a JMESPath search on an input JSON format, when using a transformer. |
SetIfEmpty | Checks an object for an empty value and returns a pre-set default value. |
If-Then-Else | A transformer for simple if-then-else logic. |
StringifyArray | Return the string encoded with JSON from the whole array |
StringToArray | Converts string to array. |
URLDecode | Converts |
RegexExtractAll | Extraction of all matches from a specified regular expression pattern from a provided string. Returns an array of results. This differs from RegexGroups in several ways:
|
RemoveEmpty | Remove empty items, entries or nodes from the array. |
RemoveMatches | Removes items from the given list of values if they match any of the patterns in the provided |
ConvertKeysToTableFieldFormat | Convert object keys to match table keys. |
BetweenHours | Checks whether the given value is within the specified time (hour) range. |
MergeDictArray | Each entry in an array is merged into the existing array if the keyed-value matches. |
ExtractInbetween | Extract a string from an existing string. |
Cut | Cut a string by delimiter and return specific fields. Exampleinput: "A-B-C-D-E" return: "A-E". |
IPv4Blacklist | Transformer that returns a filtered list of IPv4 addresses, based on whether they do not match a comma-separated list of IPv4 ranges. Useful for filtering out internal IP address space. |
IsRFC1918Address | A filter that receives a single IPv4 address string as an input and determines whether it is in the private RFC-1918 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). For more information, see https://en.wikipedia.org/wiki/Private_network |
FirstArrayElement | Returns the first element of an array. If the value passed is not an array, it returns the original value that was passed. |
DateStringToISOFormat | This is a thin wrapper around the |
AfterRelativeDate | Checks the given datetime has occured after the provided relative time. |
URLEncode | Encodes a URL string by replacing special characters in the string using the %xx escape. For example: https://example.com converts to https:%2F%2Fexample.com. |
ProductJoin | Returns the product of two lists, joined by a separator, as a list of strings. |
MapRangeValues | This script converts an input value into another value using two lists. The input value or range is searched in the first list (map_from). Example 1: map_from = "1,2,3,4" Output is "2" Example 2: map_from = "1-3,4" Output is "5". |
Base64Decode | Decodes an input in Base64 format. |
BetweenDates | Whether value is within a date range. |
GetRange | Gets specified indexes of a list. |
JsonToTable | Accepts a json object and returns a markdown. Supports clickable links. |
SortBy | This transformer will sort an array of dictionary values by keys in ascending or descending order. |
DedupBy | This transformer will remove elements of the array that contain an identical combination of values for the keys given. |
IPv4Whitelist | Transformer that returns a filtered list of IPv4 addresses, based on whether they match a comma-separated list of IPv4 ranges. Useful for filtering in internal IP address space. |
RegexReplace | Format patterns matched with regex. If the regex does not match any pattern, the original value is returned. Example 1: Example 2: |
Pack Name | Pack By |
---|---|
Base | By: Cortex XSOAR |
Pack Name | Pack By |
---|
Pack Name | Pack By |
---|---|
Base | By: Cortex XSOAR |
Code functionality and documentation improvements.
Code functionality and documentation improvements.
Certification | Certified | Read more |
Supported By | Cortex | |
Created | January 4, 2022 | |
Last Release | August 27, 2025 |