Parsing the fields from xml input using python script

SecOps
1

Hi ,

I am trying to automate the SIEM triage process for the Arcsight alerts.
I can see the Arcsight alerts as xml format in swimlane. Now I need to parse the different fields in the xml input so that i can display it for the analyst. I tried a custom python script for this , the script is returning results in the debugger , but in the actual record when I run this , the result is empty for some fields such as base event ids , not throwing any error also.

Do you have any inputs for this ? has any one faced this before or do you have any working script for this ?

Thanks ,
Arjun

2

Hi Arjun,

This isn’t an error I’ve run into with custom scripts debugging properly but not populating record fields. Have you double checked everything on the Outputs screen to make sure that the Update Current Record parameters are all correct and exactly identical to the variable names in your sw_outputs variable?

3

Thank you Nikkuman for your inputs. I tried it and worked fine