Describe the issue/error/question
I am developing my first node and am experiencing a seemingly common error whereby I would like to make an endpoint return a nested array as a single item. I know there is a code snippet to make this work, however, I keep running into an issue.
return items[0].json.map(item => {
return {
json: item
}
});
This is the data structure.
[
[
{
"username_count": 0,
"description": "Possible UAC Bypass - A Scheduled Task Has Been Configured to Run With Highest Privileges containing Success Audit: A scheduled task was updated ",
"rules": [
{
"id": 100407,
"type": "CRE_RULE"
}
],
"event_count": 13,
"flow_count": 0,
"assigned_to": null,
"security_category_count": 3,
"follow_up": false,
"source_address_ids": [
6
],
"source_count": 1,
"inactive": false,
"protected": false,
"closing_user": null,
"destination_networks": [
"Net-10-172-192.Net_172_16_0_0"
],
"source_network": "Net-10-172-192.Net_172_16_0_0",
"category_count": 3,
"close_time": null,
"remote_destination_count": 0,
"start_time": 1639764968556,
"magnitude": 4,
"last_updated_time": 1639775131611,
"credibility": 3,
"id": 20,
"categories": [
"Information",
"Misc Suspicious Event",
"Scheduled Task Creation Success"
],
"severity": 6,
"policy_category_count": 0,
"log_sources": [
{
"type_name": "EventCRE",
"type_id": 18,
"name": "Custom Rule Engine-8 :: prod-qrdr01",
"id": 63
},
{
"type_name": "WindowsAuthServer",
"type_id": 12,
"name": "WindowsAuthServer @ PROD-WKST01",
"id": 112
}
],
"closing_reason_id": null,
"device_count": 2,
"offense_type": 0,
"relevance": 2,
"domain_id": 0,
"offense_source": "172.16.20.129",
"local_destination_address_ids": [
4
],
"local_destination_count": 1,
"status": "OPEN"
},
{
"username_count": 0,
"description": "Possible UAC Bypass - A Scheduled Task Has Been Configured to Run With Highest Privileges containing Success Audit: A scheduled task was updated ",
"rules": [
{
"id": 100407,
"type": "CRE_RULE"
}
],
"event_count": 28,
"flow_count": 0,
"assigned_to": null,
"security_category_count": 3,
"follow_up": false,
"source_address_ids": [
6
],
"source_count": 1,
"inactive": true,
"protected": false,
"closing_user": null,
"destination_networks": [
"Net-10-172-192.Net_172_16_0_0"
],
"source_network": "Net-10-172-192.Net_172_16_0_0",
"category_count": 3,
"close_time": null,
"remote_destination_count": 0,
"start_time": 1638555204525,
"magnitude": 2,
"last_updated_time": 1638628785460,
"credibility": 3,
"id": 19,
"categories": [
"Information",
"Misc Suspicious Event",
"Scheduled Task Creation Success"
],
"severity": 6,
"policy_category_count": 0,
"log_sources": [
{
"type_name": "EventCRE",
"type_id": 18,
"name": "Custom Rule Engine-8 :: prod-qrdr01",
"id": 63
},
{
"type_name": "WindowsAuthServer",
"type_id": 12,
"name": "WindowsAuthServer @ PROD-WKST01",
"id": 112
}
],
"closing_reason_id": null,
"device_count": 2,
"offense_type": 0,
"relevance": 0,
"domain_id": 0,
"offense_source": "172.16.20.129",
"local_destination_address_ids": [
4
],
"local_destination_count": 1,
"status": "OPEN"
}
]
]
What is the error message (if any)?
I keep getting the following error, I feel like it should be a simple fix but I am not much of a javascript developer.
TypeError: Cannot read property 'map' of undefined
I tried just implementing this as my code.
return returnData[0].json.map(item => {
return {
json: item
}
Any help would be greatly appreciated.
Share the output returned by the last node
This is the desired output.
[
{
"username_count": 0,
"description": "Possible UAC Bypass - A Scheduled Task Has Been Configured to Run With Highest Privileges containing Success Audit: A scheduled task was updated ",
"rules": [
{
"id": 100407,
"type": "CRE_RULE"
}
],
"event_count": 13,
"flow_count": 0,
"assigned_to": null,
"security_category_count": 3,
"follow_up": false,
"source_address_ids": [
6
],
"source_count": 1,
"inactive": false,
"protected": false,
"closing_user": null,
"destination_networks": [
"Net-10-172-192.Net_172_16_0_0"
],
"source_network": "Net-10-172-192.Net_172_16_0_0",
"category_count": 3,
"close_time": null,
"remote_destination_count": 0,
"start_time": 1639764968556,
"magnitude": 4,
"last_updated_time": 1639775131611,
"credibility": 3,
"id": 20,
"categories": [
"Information",
"Misc Suspicious Event",
"Scheduled Task Creation Success"
],
"severity": 6,
"policy_category_count": 0,
"log_sources": [
{
"type_name": "EventCRE",
"type_id": 18,
"name": "Custom Rule Engine-8 :: prod-qrdr01",
"id": 63
},
{
"type_name": "WindowsAuthServer",
"type_id": 12,
"name": "WindowsAuthServer @ PROD-WKST01",
"id": 112
}
],
"closing_reason_id": null,
"device_count": 2,
"offense_type": 0,
"relevance": 2,
"domain_id": 0,
"offense_source": "172.16.20.129",
"local_destination_address_ids": [
4
],
"local_destination_count": 1,
"status": "OPEN"
},
{
"username_count": 0,
"description": "Possible UAC Bypass - A Scheduled Task Has Been Configured to Run With Highest Privileges containing Success Audit: A scheduled task was updated ",
"rules": [
{
"id": 100407,
"type": "CRE_RULE"
}
],
"event_count": 28,
"flow_count": 0,
"assigned_to": null,
"security_category_count": 3,
"follow_up": false,
"source_address_ids": [
6
],
"source_count": 1,
"inactive": true,
"protected": false,
"closing_user": null,
"destination_networks": [
"Net-10-172-192.Net_172_16_0_0"
],
"source_network": "Net-10-172-192.Net_172_16_0_0",
"category_count": 3,
"close_time": null,
"remote_destination_count": 0,
"start_time": 1638555204525,
"magnitude": 2,
"last_updated_time": 1638628785460,
"credibility": 3,
"id": 19,
"categories": [
"Information",
"Misc Suspicious Event",
"Scheduled Task Creation Success"
],
"severity": 6,
"policy_category_count": 0,
"log_sources": [
{
"type_name": "EventCRE",
"type_id": 18,
"name": "Custom Rule Engine-8 :: prod-qrdr01",
"id": 63
},
{
"type_name": "WindowsAuthServer",
"type_id": 12,
"name": "WindowsAuthServer @ PROD-WKST01",
"id": 112
}
],
"closing_reason_id": null,
"device_count": 2,
"offense_type": 0,
"relevance": 0,
"domain_id": 0,
"offense_source": "172.16.20.129",
"local_destination_address_ids": [
4
],
"local_destination_count": 1,
"status": "OPEN"
}
]