July 15, 2022 - The Rewst platform and how to use DateTime comparisons in Jinja

In this call, we're going to have a quick refresh on the platform to understand some of the recent changes both in navigation and on the backend.

We're also going to look at how to use DateTime objects to either compare to other formatted DateTIme or understand the current date +/- x days/time

Finally, we'll be looking through some client workflows using SentinelOne!

It's a fully packed ROC Open Mic call today!

Contents of the recording

Rewst Platform Refresher

Basic features of the platform - Integrations - Workflows - Forms - Triggers - Templates - Scripts - Organization variables - Results - Crates Jinja - Set and Use variables - jedi: Obiwan Kenobi - last_name: {{ CTX.jedi.split(' ')[1] }} - Filters - lower - replace - jedi_s: {{ CTX.jedi | replace (' ','_') | lower }} - Task Results

How to get help from the ROC

How to get help - Engage the ROC in Slack - Email support coming soon! - [FUTURE] Live chat in the app - Would this be helpful to people? - Documentation - https://rewst.help - Feature Requests - https://rewst.canny.io/

Updates for the week

• Moar Horsepower - engine upgrades for RAM + CPU

• DateTime Comparisons

  • now_formatted ->

  • two_days_ago ->

  • format_datetime from a datetime object to a specified string format

    • It was a {{ ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday"]["2022-07-04T11:38:00" | format_datetime("%w") | int] }}

  • load_datetime: from a datetime object to a specified string format

    • {{ "06-09-2022" | load_datetime("%m-%d-%Y") }}

  • time_delta to add/subtract units from a datetime object

    • {{ "06-09-2022" | load_datetime("%m-%d-%Y") | time_delta(days=-30) | format_datetime("%B %d, %Y") }}

  • Help with Date Formats: https://strftime.org/

Show and Tell

• Michael w/ CPI will show his SentinelOne WF

  • Takes phishing alerts

  • Finds URLs in the report

  • Checks URLs against SentinelOne Deep Visibility

  • Parses DV data for whether other endpoints have visited the URLs

  • Places into CWM Ticket Notes

Open Q&A

• Jared w/ SnapTech

  • Graph API problems

    • Adam finds some magic JSON to fix it [maybe]