try to make tag from Sample Payload
Asked by Reham Adel:

try to make a tag from Sample Payload

\`\`\`

{ "Type": "Notification",

"MessageId": "96d4c7c2-999e-57ab-aade",

"TopicArn": "arn:aws:sns:us-west-2:test",

"Message": "{\\"version\\":\\"0\\",\\"id\\":\\"3ee38987-e0ce--91a1\\",\\"detail-type\\":\\"EC2 Instance State-change Notification\\",\\"source\\":\\"aws.ec2\\",\\"account\\":\\"abc\\",\\"time\\":\\"2017-09-11T10:49:41Z\\",\\"region\\":\\"us-west-2\\",\\"resources\\":\[\\"arn:aws:ec2:us-west-2:asdf:instance/i-abc\\"\],\\"detail\\":{\\"actionName\\":\\"custom-action-name\\",\\"actionDescription\\":\\"description of the action\\",\\"**findings** \\":\[{\\"AwsAccountId\\": \\"abc\\",\\"**Compliance** \\": {\\"**Status** \\": \\"++**PASSED**++ \\"},\\"Confidence\\": 42,\\"CreatedAt\\": \\"2017-03-22T13:22:13.933Z\\",\\"Criticality\\": 99,\\"Description\\": \\"The version of openssl found on instance i-abcd1234 is known to contain a vulnerability.\\",\\"FirstObservedAt\\": \\"2017-03-22T13:22:13.933Z\\",\\"GeneratorId\\": \\"acme-vuln-9ab348\\",\\"Id\\": \\"us-west-2/111111111111/98aebb2207407c87f51e89943f12b1ef\\",\\"LastObservedAt\\": \\"2017-03-23T13:22:13.933Z\\",\\"Malware\\": \[{\\"Name\\": \\"Stringler\\",\\"Type\\": \\"COIN_MINER\\",\\"Path\\": \\"/usr/sbin/stringler\\",\\"State\\": \\"OBSERVED\\"}\],\\"Network\\": {\\"Direction\\": \\"IN\\",\\"Protocol\\": \\"TCP\\",\\"SourceIpV4\\": \\"1.2.3.4\\",\\"SourceIpV6\\": \\"FE80:CD00:0000:0CDE:1257:0000:211E:729C\\",\\"SourcePort\\": \\"42\\",\\"SourceDomain\\": \\"here.com\\",\\"SourceMac\\": \\"00:0d:83:b1:c0:8e\\",\\"DestinationIpV4\\": \\"2.3.4.5\\",\\"DestinationIpV6\\": \\"FE80:CD00:0000:0CDE:1257:0000:211E:729C\\",\\"DestinationPort\\": \\"80\\",\\"DestinationDomain\\": \\"there.com\\"},\\"Note\\": {\\"Text\\": \\"Don't forget to check under the mat.\\",\\"UpdatedBy\\": \\"jsmith\\",\\"UpdatedAt\\": \\"2018-08-31T00:15:09Z\\"},\\"Process\\": {\\"Name\\": \\"syslogd\\",\\"Path\\": \\"/usr/sbin/syslogd\\",\\"Pid\\": 12345,\\"ParentPid\\": 56789,\\"LaunchedAt\\": \\"2018-09-27T22:37:31Z\\",\\"TerminatedAt\\": \\"2018-09-27T23:37:31Z\\"},\\"ProductArn\\": \\"arn:aws:securityhub:us-east-1:111111111111:product/111111111111/default\\",\\"ProductFields\\": {\\"generico/secure-pro/Count\\": \\"6\\",\\"Service_Name\\": \\"cloudtrail.amazonaws.com\\",\\"aws/inspector/AssessmentTemplateName\\": \\"My daily CVE assessment\\",\\"aws/inspector/AssessmentTargetName\\": \\"My prod env\\",\\"aws/inspector/RulesPackageName\\": \\"Common Vulnerabilities and Exposures\\"},\\"RecordState\\": \\"ACTIVE\\",\\"RelatedFindings\\": \[{ \\"ProductArn\\": \\"arn:aws:securityhub:us-west-2::product/aws/guardduty\\",\\"Id\\": \\"123e4567-e89b-12d3-a456-426655440000\\" },{ \\"ProductArn\\": \\"arn:aws:securityhub:us-west-2::product/aws/guardduty\\",\\"Id\\": \\"AcmeNerfHerder--x189dx7824\\" }\],\\"Remediation\\": {\\"Recommendation\\": {\\"Text\\": \\"Run sudo yum update and cross your fingers and toes.\\",\\"Url\\": \\"[http://myfp.com/recommendations/dangerous_things_and_how_to_fix_them.html\\](http://myfp.com/recommendations/dangerous_things_and_how_to_fix_them.html\)"}},\\"Resources\\": \[{\\"Type\\": \\"AwsEc2Instance\\",\\"Id\\": \\"i-cafebabe\\",\\"Partition\\": \\"aws\\",\\"Region\\": \\"us-west-2\\",\\"Tags\\": {\\"billingCode\\": \\"Lotus-1-2-3\\",\\"needsPatching\\": \\"true\\"},\\"Details\\": {\\"AwsEc2Instance\\": {\\"Type\\": \\"i3.xlarge\\",\\"ImageId\\": \\"ami-abcd1234\\",\\"IpV4Addresses\\": \[ \\"54.194.252.215\\", \\"192.168.1.88\\" \],\\"IpV6Addresses\\": \[ \\"2001:db8:1234:1a2b::123\\" \],\\"KeyName\\": \\"my_keypair\\",\\"IamInstanceProfileArn\\": \\"arn:aws:iam:::instance-profile/AdminRole\\",\\"VpcId\\": \\"vpc-11112222\\",\\"SubnetId\\": \\"subnet-56f5f633\\",\\"LaunchedAt\\": \\"2018-05-08T16:46:19.000Z\\"}}}\],\\"SchemaVersion\\": \\"2018-10-08\\",\\"Severity\\": {\\"Product\\": 8.3,\\"Normalized\\": 25},\\"SourceUrl\\": \\"string\\",\\"ThreatIntelIndicators\\": \[{\\"Type\\": \\"IPV4_ADDRESS\\",\\"Value\\": \\"8.8.8.8\\",\\"Category\\": \\"BACKDOOR\\",\\"LastObservedAt\\": \\"2018-09-27T23:37:31Z\\",\\"Source\\": \\"Threat Intel Weekly\\",\\"SourceUrl\\": \\"[http://threatintelweekly.org/backdoors/8888\\](http://threatintelweekly.org/backdoors/8888\)"}\],\\"Title\\": \\"title\\",\\"Types\\": \[\\"Software and Configuration Checks/Vulnerabilities/CVE\\"\],\\"UpdatedAt\\": \\"123578964332\\",\\"UserDefinedFields\\": {\\"reviewedByCio\\": \\"true\\",\\"comeBackToLater\\": \\"Check this again on Monday\\"},\\"VerificationState\\": \\"string\\",\\"WorkflowState\\": \\"NEW\\"}\]}}",

"Timestamp": "2017-09-11T10:49:42.630Z",

"SignatureVersion": "1",

"Signature": "sign",

"SigningCertURL": "<https://sns.us-west-2.amazonaws.com/SimpleNotification.pem>", "UnsubscribeURL": "[https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe\&SubscriptionArn=arn:aws:sns:us-west-2](https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2):" }

\`\`\`

I need the value of status in **Compliance . I** bold it with black

I tried that two expressions but returned invalid:

{{_payload.message.findings\[0\]\["Compliance"\]\["Status"\]}}

{{_payload.message.findings\[0\].Compliance.Status}}


Answers:
author: Darryl Lee
body: Hi [@Reham Adel](/t5/user/viewprofilepage/user-id/4661389),

This is Darryl. I am here to help. ?

Understand that you would like to leverage the [String Processing Method](https://support.atlassian.com/opsgenie/docs/string-processing-methods-in-opsgenie-integrations/) to extract the wanted information within a list object of the JSON.

Please note that we are not able to assist you with tailoring the expression for cases.

In this case, unfortunately, the items within a list object are not possible to be iterated by Opsgenie via String Processing Method.

There is also a feature request to address the current limitation of extracting values from a list object. It is [OPSGENIE-171](https://jira.atlassian.com/browse/OPSGENIE-171), please vote for it and set yourself as a Watcher to receive the latest updates.

As an alternative, please consider applying the [Regular Expressions](https://support.atlassian.com/opsgenie/docs/regular-expressions-for-improved-alert-filtering/) to see if it helps.

Thank you.

Kind regards,   
Darryl Lee  
Support Engineer, Atlassian


Tags: cloud