Entity Selection

[Joseph3]

Hello, Please I have a question on the entity selection, is there a way to display or use those entities selected in the playbook step individually?

[Marek_Kreul]

I guess my question here https://siemplifycommunity.slack.com/archives/C01FTP44AMR/p1625649160112000 is exactly the same :)

[Joseph3]

Yes, Marek, it would have been nice if it offers more flexibility. When I was working with Fortisoar, a playbook action can execute multiple times by defining a for loop inside of the playbook step and also allows to specify variables in steps or manipulate input and output with inbuilt Jinja functions.

[JoshShomo]

do you mind adding some details on exactly what you’re doing? Which entities you’re specifying and for which playbook action?
The entities you select can be used by the playbook step’s python code with by looping over the siemplify.target_entities , but it would be easier to confirm what’s happening if you specify the playbook and playbook step.

[JoshShomo]

Nice! glad you figured it out!

[Joseph3]

@JoshShomo , I wasn't familiar with the overall operation of the entity selection before but i get it now. Thanks

[Marek_Kreul]

So this means that you can only use that in custom coded integration actions?
I also needed something similar, for usecases such as "perform an enrichment on all internal entities, and post a general insight / entity with the specific(!) result per entity".
Usually when I enrich 2 internal entities in an alert from e.g. my asset database for their OS, and post the result as an entity insight, I get "Insight entity 1: windows, linux", and "Insight entity 2: windows, linux".
So each entity insight contain the lookup results of both lookups.