z1pti3/jimiPlugin-asset

Return Fields with Custom Names in assetSearch

b1scuit-thi3f opened this issue · 0 comments

As we can now save values inside fields, when JIMI pulls them out via assetSearch he will return something like this:
name, fields.src_ip, fields.operating_system, etc. Because these aren't as easy to reference, it would be nice to have an option to either

  • a) remove the fields. prefix (although this could cause conflicts if anything in fields shares a name with the top level fields, like name, lastSeen, etc)
  • b) have an additional form object that lets users specify what to rename any of the returned values to. This would give more control over the values passed down the flow.