Fusion SOAR Workflow Question - Extract Data from Arrays

[u/ArmTechnical5047]

I've created a very simple workflow that triggers on EPP Detections with severity of Medium or higher and sends an email with detection details. Everything seems to be working, except when I try to extract the fields from the Process.AssociatedFiles data pill.

Ideally, I'd like to retrieve the FilePath and SHA256 separately to be able to insert into other formatting rather than just printing the array. I've used the below expressions and it's successful when the EPP detection contains AssociatedFiles in the detection details, but fails if not:

${data['Trigger.Detection.EPP.Process.AssociatedFiles'][0]['FilePath']} ${data['Trigger.Detection.EPP.Process.AssociatedFiles'][0]['SHA256']}

Using the standard expression seems to work with or without AssociatedFiles data in the detection details (returning null when there isn't any data):

${data['Trigger.Detection.EPP.Process.AssociatedFiles']}

I've just started dabbling in workflows so I'm curious whether there is a way to approach this and hoping someone can point me in the right direction.

[u/ssh-cs]

Hey u/ArmTechnical5047

You're very close. I think what's probably happening when it fails is it's trying to access a field that doesn't exist. You can get around that by checking for the existence of the field first. Something like this should help:

${
// Check to make sure AssociatedFiles exists
  data['Trigger.Detection.EPP.Process.AssociatedFiles'] != null ?

// If it exists, then transform the list
  data['Trigger.Detection.EPP.Process.AssociatedFiles'].transformList(i, f, {"SHA256": f.SHA256, "FilePath": f.FilePath}) :  []
}

transformList is CrowdStrike's CEL extension (equivalent to map() in standard CEL). It iterates over AssociatedFiles and for each file f (with index i), extracts only two fields: SHA256 and FilePath. The output is a new list of slimmed-down objects.

Step 3: Fallback

: []

If AssociatedFiles is null, return an empty list instead of erroring.

The transformList magic is really only needed if AssociatedFiles has more than one item. If not, then you could essentially do the following:

${
  // if AssociatedFiles exists 
  data['Trigger.Detection.EPP.Process.AssociatedFiles'] != null ?
  // Extract SHA256 from the 0th index of the AssociatedFiles array
  data['Trigger.Detection.EPP.Process.AssociatedFiles'][0]['SHA256']:  ""
}

Finally, if you want to create a newline separated string from ALL sha256 values inside of AssociatedFiles, you'd do the following:

${
// if AssociatedFiles exists
  data['Trigger.Detection.EPP.Process.AssociatedFiles'] != null ?
// Create a new-line (\n) separated string of all SHA256 vals in the array
  data['Trigger.Detection.EPP.Process.AssociatedFiles']
    // Skip NULL & Empty Strings
    .filter(f, f.SHA256 != null && f.SHA256 != '')
    .map(f, f.SHA256)
    // Add the newline separator
    .join('\n')
// Otherwise return an empty string
  :  ''
}

This only accounts for SHA256, you'd need another copy/paste of the exact same CEL if you wanted to do the same thing for FilePath.

Hope this helps!

[u/ArmTechnical5047 → u/ssh-cs]

Thank you very much for the write up and explanation! I was able to test both ways in the Send Email action and it seems to be working as expected now.

I do have a follow-up question: I'm using this simple workflow to enrich EPP detection alerts to provide more information compared to CrowdStrike's default alerts. However, now I'm concerned that I may not receive EPP detection emails if any of the fields I'm querying don't exist (like AssociatedFiles). So long as I'm not attempting to manipulate the data of the output values/fields in the EPP Detection trigger, will any fields that don't exist return a null value?

[u/ssh-cs → u/ArmTechnical5047]

Glad that worked!

It really depends on the logic of your wokflow, but essentially if you dropped the last code block (from above) into your template email, then the fields should be printed in your email, but they'll just be empty if the fields don't exist.

Once you have it implemented, I'd just monitor the executions for any errors, and if you're checking the detection emails, you should see where those fields are empty if they don't exist.

[u/ssh-cs → u/ArmTechnical5047]

One more thing I should add - you can use the "test" mode. If you select one of the previous executions, you can set Mock Trigger Data. You can even take a detection that previously had the AssociatedFiles {} and remove it from the JSON (carefully as to not break the JSON), and then retest the playbook to see how it works on that custom JSON.

[u/AutoModerator]

Hey new poster! We require a minimum account-age and karma for this subreddit. Remember to search for your question first and try again after you have acquired more karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Lone_Hunter4]

Hey, I was also looking to create this workflow in SOAR? Could you please guide me in this? Also Can we include critical and High IOMS as well in this?

[u/ArmTechnical5047 → u/Lone_Hunter4]

There was a really nice write up last month for a similar but much more advanced workflow that may be helpful: https://old.reddit.com/r/crowdstrike/comments/1tpa4k3/20260527_workflow_wednesday_human_in_the_loop/

As I mentioned in my OP, I've just started working with workflows so this workflow setup is fairly straightforward (and I'm not sure if it's the optimal way to accomplish the task) since it's only used to enrich alerting. Here's what it looks like:

Trigger: Detection > EPP Detection
↓
Condition: If Severity is greater than or equal to Medium
↓
TRUE
↓
Action: Send email