topic Re: How to use Python Query arguments in workflow script in Cisco XDR

How to use Python Query arguments in workflow script

Arthur Dent — Mon, 27 Jan 2025 15:46:27 GMT

Hi all.

Quite simply: I'm receiving a webhook from Meraki, extracting the relevent information using JSONPath Query, and can see them when viewing the run of the workflow.

However, I've yet to work out how to actually use these within the python script that follows the JSONPath Query.

os.environ doesn't work, nor does

print(sys.argv)

args = parser.parse_args())

Quite simply, how do I see the script arguments from within the Python?

Re: How to use Python Query arguments in workflow script

bigevilbeard — Mon, 27 Jan 2025 16:08:08 GMT

By no means an expert on this, but to use query arguments or extracted data from a webhook in a Python script within your workflow, you would needs to pass the data from the previous step ( this is your JSONPath Query) to the Python script. But... the exact method depends which workflow automation tool you're using (this might change if you are using Zapier, Make, n8n, or your own custom build etc.. ) So for example if say you are using a tool like Zapier or Make, the output of the JSONPath Query step is typically available as input to the next step which is your Python script.

Hope this helps.

Re: How to use Python Query arguments in workflow script

Arthur Dent — Mon, 27 Jan 2025 16:15:10 GMT

This is just a simple webhook, and as you can see, I can see the script arguments that I've created using variables. All good so far, but nothing I try allows me to see these variables within Python script

Re: How to use Python Query arguments in workflow script

bigevilbeard — Mon, 27 Jan 2025 16:27:04 GMT

Arh ok.. try and add print statement at the beginning of your script to inspect what is being passed in (you could also use sys.argv if this is supported). This should tell you what variables are available to your script, you can look for a variable that contains your arguments, i would guess it might be something like args, arguments, input_data, or similar.

print(dir()) print(globals()) print(locals())

EDIT: Saw you used sys.argv above. Maybe

import sys # Print all arguments for debugging print("Script arguments:", sys.argv) # Access specific arguments if len(sys.argv) > 1: arg1 = sys.argv[1] # First argument arg2 = sys.argv[2] # Second argument arg3 = sys.argv[3] # Third argument print(f"Argument 1: {arg1}") print(f"Argument 2: {arg2}") print(f"Argument 3: {arg3}") else: print("No arguments provided.")

Re: How to use Python Query arguments in workflow script

Arthur Dent — Mon, 27 Jan 2025 16:31:50 GMT

Not that this is documented anywhere, but you hit the (X) and click on the variable that you wish to use.

Re: How to use Python Query arguments in workflow script

bigevilbeard — Mon, 27 Jan 2025 16:48:39 GMT

Interesting this might explain why your standard Python argument passing mechanisms were not working as the meraki platform is handling the data transfer behind the scenes. Hmm so say for example you might have a JSONPath Query that extracts organizationId, you can insert it into your script as shown in your screenshot, then you can insert this

print("Start") someVar = JSONPath Query...organizationId # Inserted variable print("Organization ID:", someVar)

This should print the value of organizationId extracted by the JSONPath Query. But guessing here.

Re: How to use Python Query arguments in workflow script

chrivand — Wed, 29 Jan 2025 08:16:46 GMT

hi @Arthur Dent , you can do 2 things to use script variables, and I agree that we can better document that here: https://docs.xdr.security.cisco.com/Content/Automate/activities-python-execute-python-script.html. I will make sure we update that section.

What you need to do is add the variables as script argument (like you did), and then you can reference it like @bigevilbeard recommended:

import sys my_first_script_argument = sys.argv[1]

Another option is to reference the variable directly in the script, as you did in your second screenshot. Both work, and some prefer one over the other. As I mentioned, I will make sure we better document this.

Just so you know, we have a lot of labs on DevNet that teach you these kind of things: https://developer.cisco.com/learning/tracks/cisco-xdr/cisco-xdr-automation/