Skip to main content

​
core.transform.apply

Apply a Python lambda function to a value.

​
Inputs

​
python_lambda
string
required
Python lambda function as a string (e.g. "lambda x: x.get('name')").
​
value
any
required
Value to apply the lambda function to.

​
Examples

Filter, transform, and compact 
- ref: normalize_hostname
  action: core.transform.apply
  args:
    value: ${{ TRIGGER.hostname }}
    python_lambda: "lambda value: value.strip().lower()"
- ref: keep_open_findings
  action: core.transform.filter
  args:
    items: ${{ TRIGGER.findings }}
    python_lambda: "lambda finding: finding.get('status') == 'open'"
- ref: finding_ids
  action: core.transform.map
  args:
    items: ${{ ACTIONS.keep_open_findings.result }}
    python_lambda: "lambda finding: finding.get('id')"
- ref: compact_ids
  action: core.transform.drop_nulls
  args:
    items: ${{ ACTIONS.finding_ids.result }}

​
core.transform.filter

Filter a collection using a Python lambda function.

​
Inputs

​
items
array[any]
required
Items to filter.
​
python_lambda
string
required
Filter condition as a Python lambda expression (e.g. "lambda x: x > 2").

​
Examples

Filter, transform, and compact 
- ref: normalize_hostname
  action: core.transform.apply
  args:
    value: ${{ TRIGGER.hostname }}
    python_lambda: "lambda value: value.strip().lower()"
- ref: keep_open_findings
  action: core.transform.filter
  args:
    items: ${{ TRIGGER.findings }}
    python_lambda: "lambda finding: finding.get('status') == 'open'"
- ref: finding_ids
  action: core.transform.map
  args:
    items: ${{ ACTIONS.keep_open_findings.result }}
    python_lambda: "lambda finding: finding.get('id')"
- ref: compact_ids
  action: core.transform.drop_nulls
  args:
    items: ${{ ACTIONS.finding_ids.result }}

​
core.transform.map

Map a Python lambda function to each item in a list.

​
Inputs

​
items
array[any]
required
Items to map the lambda function to.
​
python_lambda
string
required
Python lambda function as a string (e.g. "lambda x: x.get('name')").

​
Examples

Filter, transform, and compact 
- ref: normalize_hostname
  action: core.transform.apply
  args:
    value: ${{ TRIGGER.hostname }}
    python_lambda: "lambda value: value.strip().lower()"
- ref: keep_open_findings
  action: core.transform.filter
  args:
    items: ${{ TRIGGER.findings }}
    python_lambda: "lambda finding: finding.get('status') == 'open'"
- ref: finding_ids
  action: core.transform.map
  args:
    items: ${{ ACTIONS.keep_open_findings.result }}
    python_lambda: "lambda finding: finding.get('id')"
- ref: compact_ids
  action: core.transform.drop_nulls
  args:
    items: ${{ ACTIONS.finding_ids.result }}

​
core.transform.drop_nulls

Remove null values from a list.

​
Inputs

​
items
array[any]
required
List of items to filter.

​
Examples

Filter, transform, and compact 
- ref: normalize_hostname
  action: core.transform.apply
  args:
    value: ${{ TRIGGER.hostname }}
    python_lambda: "lambda value: value.strip().lower()"
- ref: keep_open_findings
  action: core.transform.filter
  args:
    items: ${{ TRIGGER.findings }}
    python_lambda: "lambda finding: finding.get('status') == 'open'"
- ref: finding_ids
  action: core.transform.map
  args:
    items: ${{ ACTIONS.keep_open_findings.result }}
    python_lambda: "lambda finding: finding.get('id')"
- ref: compact_ids
  action: core.transform.drop_nulls
  args:
    items: ${{ ACTIONS.finding_ids.result }}

​
core.transform.is_in

Filters items in a list based on whether they are in a collection.

​
Inputs

​
collection
array[any]
required
Collection of hashable items to check against.
​
items
array[any]
required
Items to filter.
​
python_lambda
string | null
Python lambda applied to each item before checking membership (e.g. "lambda x: x.get('name')"). Similar to key in the Python sorted function.Default: null.

​
Examples

Keep or exclude matching items 
- ref: keep_known_users
  action: core.transform.is_in
  args:
    items: ${{ TRIGGER.users }}
    collection:
      - alice@example.com
      - bob@example.com
    python_lambda: "lambda user: user.get('email')"
- ref: remove_known_users
  action: core.transform.not_in
  args:
    items: ${{ TRIGGER.users }}
    collection:
      - alice@example.com
      - bob@example.com
    python_lambda: "lambda user: user.get('email')"

​
core.transform.not_in

Filters items in a list based on whether they are not in a collection.

​
Inputs

​
collection
array[any]
required
Collection of hashable items to check against.
​
items
array[any]
required
Items to filter.
​
python_lambda
string | null
Python lambda applied to each item before checking membership (e.g. "lambda x: x.get('name')"). Similar to key in the Python sorted function.Default: null.

​
Examples

Keep or exclude matching items 
- ref: keep_known_users
  action: core.transform.is_in
  args:
    items: ${{ TRIGGER.users }}
    collection:
      - alice@example.com
      - bob@example.com
    python_lambda: "lambda user: user.get('email')"
- ref: remove_known_users
  action: core.transform.not_in
  args:
    items: ${{ TRIGGER.users }}
    collection:
      - alice@example.com
      - bob@example.com
    python_lambda: "lambda user: user.get('email')"

​
core.transform.deduplicate

Deduplicate a JSON object or a list of JSON objects given a list of keys. Returns a list of deduplicated JSON objects.

​
Inputs

​
items
object | array[object]
required
JSON object or list of JSON objects to deduplicate.
​
keys
array[string]
required
List of JSONPath keys to deduplicate by. Supports dot notation for nested keys (e.g. ['user.id']).
​
expire_seconds
integer
Time to live for the deduplicated items in seconds. Defaults to 1 hour.Default: 3600.
​
persist
boolean
Whether to persist deduplicated items across calls. If True, deduplicates across calls. If False, deduplicates within the current call only.Default: true.

​
Examples

Deduplicate by a stable key 
- ref: deduplicate_findings
  action: core.transform.deduplicate
  args:
    items: ${{ TRIGGER.findings }}
    keys:
      - finding_id
    persist: true
    expire_seconds: 3600
- ref: finding_seen
  action: core.transform.is_duplicate
  args:
    item: ${{ TRIGGER.finding }}
    keys:
      - finding_id
    expire_seconds: 3600

​
core.transform.is_duplicate

Check if a JSON object was recently seen.

​
Inputs

​
item
object
required
JSON object to check.
​
keys
array[string]
required
List of JSONPath keys to check.
​
expire_seconds
integer
Time to live for the deduplicated items in seconds. Defaults to 1 hour.Default: 3600.

​
Examples

Deduplicate by a stable key 
- ref: deduplicate_findings
  action: core.transform.deduplicate
  args:
    items: ${{ TRIGGER.findings }}
    keys:
      - finding_id
    persist: true
    expire_seconds: 3600
- ref: finding_seen
  action: core.transform.is_duplicate
  args:
    item: ${{ TRIGGER.finding }}
    keys:
      - finding_id
    expire_seconds: 3600

​
core.transform.flatten_json

Flatten a JSON object into a single level of fields.

​
Inputs

​
json
string | object
required
JSON object to flatten.

​
Examples

Flatten and query JSON 
- ref: flatten_alert
  action: core.transform.flatten_json
  args:
    json: ${{ TRIGGER.alert }}
- ref: extract_fields
  action: core.transform.eval_jsonpaths
  args:
    json: ${{ TRIGGER.alert }}
    jsonpaths:
      user: $.actor.email
      source_ip: $.network.source.ip

​
core.transform.eval_jsonpaths

Eval multiple JSONPath expressions on an object.

​
Inputs

​
json
string | object
required
JSON object to eval JSONPath expressions on.
​
jsonpaths
array[string]
required
JSONPath expressions to eval.

​
Examples

Flatten and query JSON 
- ref: flatten_alert
  action: core.transform.flatten_json
  args:
    json: ${{ TRIGGER.alert }}
- ref: extract_fields
  action: core.transform.eval_jsonpaths
  args:
    json: ${{ TRIGGER.alert }}
    jsonpaths:
      user: $.actor.email
      source_ip: $.network.source.ip