Workbench Panels are not handling tokens with multiple values correctly. about security_content HOT 5 CLOSED

This issue is fixed in 3.10.0. Thank you @knadkarni-splunk for creating this and giving details

from security_content.

@knadkarni-splunk : those work bench searches are intended to work with single artifacts only. There is no easy way currently to customize those with our current tooling.

from security_content.

@patel-bhavin Can't the panels be designed to take multiple values for tokens into account (Using delimiters ,value prefix and value suffix)? Can this be addressed in an upcoming release?

from security_content.

@knadkarni-splunk : After doing a bunch of testing/tweaks with our current script that generates es_investigations.conf , it seems like we might be able to handle multiple values.

That said, it looks like a size-able amount of work as we'd have to update all the searches in the response tasks directory. Will keep you posted on when this will be ready

from security_content.

tracking this in https://github.com/splunk/security-content/pull/new/workbench_issue_697 -> no longer a correct branch

New branch: #987

from security_content.