I am taking the first steps with the SOAR capability in LP7.
I am trying to use the Nexpose API to enrich data of a device, and collect info like OS, number of vulnerabilities etc using the nexpose-search-assets Action, as this can filter on an IP address and doesn’t need the Nexpose device ID.
The filters are in the request body in JSON format.
The Logpoint action for this has the following in the request body (out of the box there are a couple of additional optional fields which I have removed as they are not needed for this).
{"filters": s{"field": "", "operator": "", "value": "",}, "match": "all"}
The field and operator can be hard coded for this action as they won’t change.
How do I configure the action so that when an IP address is passed into the action in a playbook, it gets inserted into the request body as the value?