XSOAR-ENGINEER · Question #59
Which two actions can be performed using filters and transformers within a playbook task? (Choose two)
The correct answer is A. Remove null values from a list C. Convert all strings in a list to lowercase. Filters and transformers are data manipulation tools applied to task inputs/outputs within playbooks: filters refine lists by applying conditions (such as removing null values - A), while transformers reshape data values (such as converting strings to lowercase - C). Both…
Question
Which two actions can be performed using filters and transformers within a playbook task? (Choose two)
Options
- ARemove null values from a list
- BMap external fields to internal incident fields
- CConvert all strings in a list to lowercase
- DConfigure incident-level permissions
- EDefine job recurrence
How the community answered
(21 responses)- A71% (15)
- B5% (1)
- D10% (2)
- E14% (3)
Explanation
Filters and transformers are data manipulation tools applied to task inputs/outputs within playbooks: filters refine lists by applying conditions (such as removing null values - A), while transformers reshape data values (such as converting strings to lowercase - C). Both operate directly on field data flowing through the playbook task, making A and C the natural fit.
B (mapping external fields to incident fields) is done through field mapping configuration, a separate concept handled during ingestion or incident layout setup - not via filters/transformers. D (incident-level permissions) is an administrative/RBAC function unrelated to data manipulation in tasks. E (defining job recurrence) is a scheduling concern handled at the job or trigger configuration level, not inside a task's filter/transformer logic.
Memory tip: Think of filters as a sieve (remove what you don't want) and transformers as a converter (change the shape of what remains) - both act on data values in a list, so any answer dealing with permissions, mapping schemas, or scheduling is automatically out of scope.
Topics
Community Discussion
No community discussion yet for this question.