Skip to main content

I am taking the first steps with the SOAR capability in LP7.

I am trying to use the Nexpose API to enrich data of a device, and collect info like OS, number of vulnerabilities etc using the nexpose-search-assets Action, as this can filter on an IP address and doesn’t need the Nexpose device ID.

The filters are in the request body in JSON format.

The  Logpoint action for this has the following in the request body (out of the box there are a couple of additional optional fields which I have removed as they are not needed for this). 


{"filters": s{"field": "",  "operator": "", "value": "",}, "match": "all"}

The field and operator can be hard coded for this action as they won’t change.  

How do I configure the action so that when an IP address is passed into the action in a playbook, it gets inserted into the request body as the value?

Hi Jon, 

Thanks for reaching out to us, your query will be answered momentarily. In the meantime if theres anything else we can help with, do not hesitate to reach out. 


Hi Jon,

In order to pass an IP address or any other parameter that you do not want to hard code, you can use ${parameter} in the request body. For example, for the nexpose-search-assets action, the request body can be {"filters": s{"field": "",  "operator": "", "value": "${value}",}, "match": "all"}.

Make sure that you enter “field”, “operator”, “value” or any other parameter you would like to use in the “Request Params” under “General” section of the Configure Action panel. This might be missing in the default action that comes with LogPoint 7.

I hope this answered your question. 

 


Hello Jon,

Adding to Priyanka’s Reply:

  • You can optionally add parameter of your name(say ip_address_holder) to provide ip_address inside trigger block. You can do this by clicking configure button of Trigger block.
  • Open the playbook properties api settings by clicking the configure button of API block in the playbook
  • Move to action parameter and scroll down to the value
  • Click on the search button next to the value which will open Configure Parameter pop up.
  • Then you can choose from Global parameters, Playbook Parameters(this contains all the i/p o/p parameters of the blocks used in playbook). (In your case select ip_address_holder from Playbook parameters ==> Trigger ==>  ip_address_holder)

The $value in {"filters": t{"field": "",  "operator": "", "value": "${value}",}, "match": "all"} takes the content of value placeholder box(i.e ip_place_holder in your case).

Additionally, you need to explicitly search and select the parameters to make it work ,i.e if you write ip_address_holder by your own in the value text box then it won’t work.


Reply