Ingest Multiple Values and Database Query Transporter
Description: I am using the database query transporter to bring in vulnerability data. One of the elements I want to bring in are a list of all of the controls the vulnerability impacts. Ex: Plugin 1 impacts AC-2;AC-2(1);SI-2. I am trying to populate a values list that is configured to be multi-select so the data is normalized and we can report on it. In the data source, we are pulling from, the values are separated by a ; delimiter. I have this field in the data feed configuration source Definition to be a "List." However, when the data imports it treats AC-2;AC-2(1);SI-2; all as one value. Is my delimiter wrong or is there a way I can bring this data in and get Archer to realize it is a list of values using the database query transporter?
We are on Archer 6.3.
- archer 6.3
- Community Thread
- Forum Thread
- Integration Issue
- RSA Archer
- RSA Archer Suite
- Tips and Tricks
Even you'll need a custom XSTL to do this. Take a look at my post here, https://community.rsa.com/message/896208?commentID=896208#comment-866248 It contains the XSLT to use and how to modify it to work with your dataset.
Thanks David! I tried to copy and paste the XSTL into the navigation transform area and update line 15 replacing the field name with <xsl:template match="NewDataSet/Table/Affected Controls"> but when I try to run the data feed it says "The data feed failed validation." Is this the only thing I have to update?
I think the "Affected Controls" is the issue; XML doesn't like spaces in node names. See if either AffectedControls or Affected_Controls will work.
If both do not, set the feed as transform only and take a look at the raw data to see how that field is named.
Progress...When I remove the space. However, now it says Scan ID is required for every row. Since I'm adding in a transform do I have to account for everything in my source? There are a lot of other fields besides just the multi-select values list? It is like it's ignoring everything else.
All the fields you're getting from the SQL query should be there when you load the fields. Are you just getting the Affected Controls field and nothing else?
Hum...I don't know what is happening. The transporter type is still Database Query, The fields show up when I originally load them but if I try to reload them with the Transform in their it wants me to upload a file instead of just executing the query to get the source definition. That seems like odd behavior. I'm about to get pulled into a meeting for the rest of the afternoon if I become unresponsive.
Ah, the fog is lifting 😄
Yes, you'll need to provide a sample file to transform against the XSLT. Archer won't do it via the UI for some reason when a custom XSLT is used.
You'll have to do a transport only feed to get the XML file and then use that to load the fields in the other data feed.