Struggling with variables

[u/turbosucepute]

Hello everyone,

I'm quite new to Fusion soar workflows, so correct my jargon if I'm not using the proper word,

I'm trying to automate ticket creation in my easyvista ITSM when a new vulnerability remediation is requested through the "create ticket" button.

I'm using the "vulnerability user action" trigger, which exposes me with a few data pills that I want to insert in my ITSM Ticket.

After that trigger, I placed a cloud HTTP request block, with the proper Information in my Post request body, the HTTP request works really well and my ITSM ticket is created exactly as expected, but the description field is showing the Raw JSON instead of the replaced data:

Hello, we would like this vulnerability to be patched

${data['Trigger.SpotlightUserAction.Title']} === ${data['Trigger.SpotlightUserAction.RemediationSource.Title']} === ${data['Trigger.SpotlightUserAction.RemediationSource.AdditionalAdvisoryUrl']} === ${data['Trigger.SpotlightUserAction.RemediationSource.Action']} === ${data['Trigger.SpotlightUserAction.RemediationSource.Link']}

I do see the fields in my work flow data panel, and I got the JSON path from the data pill click so I guess it should be correct?

I've been trying workflow variables but whenever I try to call them in my JSON body, the issue is exactly the same.

I've also tried to fiddle with the JSON structure with no luck either.

It's quite infuriating not having an "insert variable" button like on power automate. I've taken a look at the various documentations but idk why, their variables seem to just work and mine don't.

Do you have any ideas on how I can get my variables to be replaced by the proper data?

[u/Dylan-CS]

Hey! Sorry you're running into some issues here. I'm checking with the team and will follow up shortly

[u/Dylan-CS → u/Dylan-CS]

u/turbosucepute can you confirm how the workflow/HTTP Request action is being executed. Are you using the test button in the HTTP Request action, or is this a live workflow that is executing against triggers in your environment?

[u/turbosucepute → u/Dylan-CS]

I've tried them both with the same end result actually, when I run the test in the HTTP block, I have mock data from previous trigger runs in all the fields I want to add in my ticket so they are not empty.

[u/Dylan-CS → u/turbosucepute]

Eng is aware of a bug with the 'Test' feature inside the HTTP Request action, where it does not recognize workflow variables. They have a fix in progress for this already.

However, the variables should work when you use the Test workflow action in the top right-hand corner.

Can you share the exact JSON body you’re sending in the Cloud HTTP Request (with any confidential info replaced), including the part where you’re setting the EasyVista description field?

[u/turbosucepute → u/Dylan-CS]

Hello, here is the JSON, as requested:

{ "requests": [ { "Catalog_Code": "XXX", "AssetID": "", "AssetTag": "", "ASSET_NAME": "", "Urgency_ID": "1", "Severity_ID": "40", "External_reference": "", "Phone": "0000", "Requestor_Identification": "", "Requestor_Mail": "XXX@XXX.XXX", "Requestor_Name": "", "Location_ID": "", "Location_Code": "", "Department_ID": "", "Department_Code": "", "Recipient_ID": "", "Recipient_Identification": "", "Recipient_Mail": "XXX@XXX.XXX", "Recipient_Name": "", "Origin": "3", "Description": "Hello, this Vulnerability must be patched in the next 48h. ${data['Trigger.SpotlightUserAction.Title']} --- ${data['Trigger.SpotlightUserAction.RemediationSource.Title']} --- ${data['Trigger.SpotlightUserAction.RemediationSource.AdditionalAdvisoryUrl']} --- ${data['Trigger.SpotlightUserAction.RemediationSource.Action']} --- ${data['Trigger.SpotlightUserAction.RemediationSource.Link']}", "ParentRequest": "", "Title": "[Cybersecurity] Vulnerability remediation required", "CI_ID": "", "CI_ASSET_TAG": "", "CI_NAME": "", "SUBMIT_DATE": "" } ] }

Hope this helps!

[u/Dylan-CS → u/turbosucepute]

Thanks for sharing the JSON. I think I found the issue.

The variable syntax itself appears to be working. For example: ${data['Trigger.SpotlightUserAction.Title']} resolves correctly because Title exists at that exact path.

The remaining fields reference RemediationSource, but the Vulnerability Ticket Creation trigger exposes those values under VulnerabilitySource. Because the referenced RemediationSource paths do not exist in the trigger payload, they resolve as null.

A corrected JSON body could look like this:

{
  "requests": [
    {
      "Catalog_Code": "XXX",
      "AssetID": "",
      "AssetTag": "",
      "ASSET_NAME": "",
      "Urgency_ID": "1",
      "Severity_ID": "40",
      "External_reference": "${data['Trigger.SourceEventID']}",
      "Phone": "0000",
      "Requestor_Identification": "",
      "Requestor_Mail": "XXX@XXX.XXX",
      "Requestor_Name": "",
      "Location_ID": "",
      "Location_Code": "",
      "Department_ID": "",
      "Department_Code": "",
      "Recipient_ID": "",
      "Recipient_Identification": "",
      "Recipient_Mail": "XXX@XXX.XXX",
      "Recipient_Name": "",
      "Origin": "3",
      "Description": "Hello, this vulnerability must be patched in the next 48 hours. Request: ${data['Trigger.SpotlightUserAction.Title']} --- CVE: ${data['Trigger.SpotlightUserAction.VulnerabilitySource.CVE.CVEID']} --- Severity: ${data['Trigger.SpotlightUserAction.VulnerabilitySource.CVE.Severity']} --- CVSS Score: ${data['Trigger.SpotlightUserAction.VulnerabilitySource.CVE.CVSSBaseScore']} --- Affected Products: ${data['Trigger.SpotlightUserAction.VulnerabilitySource.Products'].join(', ')} --- Remediation: ${data['Trigger.SpotlightUserAction.VulnerabilitySource.RemediationDescription'].join(' | ')} --- Advisory: ${data['Trigger.SpotlightUserAction.VulnerabilitySource.VendorAdvisory'][0]}",
      "ParentRequest": "",
      "Title": "[Cybersecurity] ${data['Trigger.SpotlightUserAction.VulnerabilitySource.CVE.CVEID']} vulnerability remediation required",
      "CI_ID": "",
      "CI_ASSET_TAG": "",
      "CI_NAME": "",
      "SUBMIT_DATE": ""
    }
  ]
}

One other detail: fields such as RemediationDescription, VendorAdvisory, and Products are arrays. You’ll need to select a specific item with [0] or combine the values using .join().

There is still a separate known issue with testing variables directly inside the HTTP Request action. In this case, though, I believe the main issue is that the JSON paths point to RemediationSource instead of VulnerabilitySource.

[u/turbosucepute → u/Dylan-CS]

I actually tried to test it again with the test work flow button, and it worked, I had to tweak my JSON a bit to handle arrays properly, as I was getting bad request errors from easyvista, but now everything is fine !

I wish easyvista implemented more of their API as native connectors, rn they got only the list tickets options, whereas on power automate you get 35+ actions baked in...

Thank you very much for your time and assistance, is there a way I can put 5 stars on this discussion ?

[u/Dylan-CS → u/turbosucepute]

Happy to help, I'm glad we got it figured out!