Step: Edit Collection

Add or a remove a text (string) value (or list of values) to or from a String Collection


Operates on table variable values

Allows Freemarker templates to select values

  • Operation:
    • Add: Select if you want to add the literal value(s) selected to the collection
    • Remove: Select if you want to remove the literal value(s) selected from the collection
  • Collection: A list of all configured collections in contextual memory to add values to or remove values from. Only String Collections can be used with this step.
    • To allow the step to create a new collection if needed, type in the selection box instead of selecting an existing collection. FreeMarker can be used to customize collections with data from the event.
  • Value to use: Names the package variable that will be added or removed from the selected collection
    • Use a variable name with no FreeMarker to add a list of items (see below)
    • Use Freemarker templates to reference values in the package table

Upgrade Notice from 3.5 to 3.6+

The Edit Collection step was updated starting in version 3.6 to use the name of the collection instead of the full IRI. If you have an existing playbook where the step refers to the collection as an IRI (e.g. tag:champtc:core#Collection-${host[0][0]}-known-usb) you will need to either select the collection from the list of existing collections, or modify the name if you are using FreeMarker (e.g. ${host[0][0]} known usb) and save the playbook.

Use the Steps in Playbook view to find the playbooks that use this step. The view can be found in the menu Window → Show View

Download and Add a List of Things into a Collection

This example shows the playbook, "Context | Firehol Collection Manager" as an example of how to download a plaintext file from the internet, extract the IP addresses from it, and list each address as an item in a Collection. This Collection can later be used with a Value or Graph CIDR Collection Filter

Step Type Step Settings
Schedule
Query Knowledge Base
SPARQL Query
DELETE {
	GRAPH <tag:champtc:core#Collection-Firehol> {
		?s <tag:champtc:core#containsLiteral> ?o
	}
} WHERE {
	GRAPH <tag:champtc:core#Collection-Firehol> {
		?s <tag:champtc:core#containsLiteral> ?o
	}
}


Collection Manager View shows IRI

Download File
RegEx
((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})|(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[^\/])
Edit Collection
  • step/edit-collection
  • Last modified: 2018/10/23 19:03