Using event metadata into run external script

[JeremyKerwin]

How do I use the metadata from an event as variables within an external script like a Python script.

The documentation here is a bit vague on how to take the metadata and use it within an external script.
https://community.rsa.com/t5/netwitness-platform-online/configure-script-as-a-notification/ta-p/644635

are there examples available?

[JeremyKerwin]

Can anyone help answer my question?

[JamesMoon]

Hi Jeremy,

Just updating this post as well in case other customers might find it useful.

The example in the following article should help you getting started.

https://community.rsa.com/t5/netwitness-blog/v11-3-changes-to-esa-script-outputs/ba-p/520732?et=watches.email.blog

def customFunction():
   esa_alert = json.loads(open("/tmp/esa_alert.json").read())
   with open("/tmp/esa_meta.txt", mode='w') as deviceclass_file:
      deviceclass_file.write(esa_alert["events"][0]["device_class"])
   with open("/tmp/esa_modulename.txt", mode='w') as modulename_file:
      modulename_file.write(esa_alert["module_name"])

The meta values loaded from /tmp/esa_alert.json can be accessed as shown in the above example.

Thanks,
James