Flow Designer Parse JSON Response using new lines on Work Notes

[Ivan39]

I'm trying to parse the JSON Response from the API call with new lines and then update the work notes. It seems like during the test, the response is not being parsed as expected.

Anyone knows how to parse this correctly so the work notes can be updated correctly using the new lines?

JSON Response sample:

{"generated":"2023-12-15T21:03:05.550Z","reports":[{"scope":"THREAT","id":"48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","name":"48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","threatStatus":"active","forensics":[{"type":"attachment","display":"Image Based TOAD Threat with SHA-256: 48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","engine":"iee","malicious":true,"note":"Attachment with SHA-256: 48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","time":0,"what":{"rule":"14ab0a31-307e-11ed-afa2-1866da63294b","sha256":"48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","blacklisted":true},"platforms":[{"name":"analyst","os":"analyst","version":"0"}]}]}]}

Sample code:

(function execute(inputs, outputs) {

var response_body = JSON.parse(inputs.ResponseBody);

var reports = response_body.reports[0].toString();

var sentences = reports.split(',');
var format = sentences.join (',\n');

outputs.responsebody = format;

})(inputs, outputs);

[Saurabh Gupta]

Hi @Ivan39 

Can you please try below in background scripts-

var t={"generated":"2023-12-15T21:03:05.550Z","reports":[{"scope":"THREAT","id":"48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","name":"48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","threatStatus":"active","forensics":[{"type":"attachment","display":"Image Based TOAD Threat with SHA-256: 48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","engine":"iee","malicious":true,"note":"Attachment with SHA-256: 48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","time":0,"what":{"rule":"14ab0a31-307e-11ed-afa2-1866da63294b","sha256":"48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495","blacklisted":true},"platforms":[{"name":"analyst","os":"analyst","version":"0"}]}]}]};

gs.info(JSON.stringify(t,null,2))

[Ivan39]

I tested on the flow designer and still got the same response. Is like it didn't apply the format.

[Narsing1]

Can you try something like this

var m = {
    "generated": "2023-12-15T21:03:05.550Z",
    "reports": [{
        "scope": "THREAT",
        "id": "48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495",
        "name": "48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495",
        "threatStatus": "active",
        "forensics": [{
            "type": "attachment",
            "display": "Image Based TOAD Threat with SHA-256: 48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495",
            "engine": "iee",
            "malicious": true,
            "note": "Attachment with SHA-256: 48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495",
            "time": 0,
            "what": {
                "rule": "14ab0a31-307e-11ed-afa2-1866da63294b",
                "sha256": "48f4f8a0b2147eaf7f340c5820fe0e97de07aaefe7e57a915b216d20523da495",
                "blacklisted": true
            },
            "platforms": [{
                "name": "analyst",
                "os": "analyst",
                "version": "0"
            }]
        }]
    }]
};

var reports = JSON.stringify(m.reports[0]);
var sentences = reports;

var b = sentences.split(",");
var format = b.join ('\n');
format = format.replaceAll("{", "");
format = format.replaceAll("}", "");

gs.print(format);

Output

Thanks,

Narsing

[Ivan39]

I tested as well on the flow designer and still get this response. For some reason, the format is not being passed to the response.