Refer to the exhibit.
Which Jinja expression correctly filters the results so that only MD5 hash values are displayed?
{{ ||json_query.") }}
This is the same FortiSOAR question as its sibling: the Jinja template pipes 'vars.artifacts' into the 'json_query' filter with the JMESPath argument that selects entries of type FileHash-MD5, then uses '.value' to emit only the MD5 hash strings. The filter that accepts a parenthesized JMESPath argument must be 'json_query', so slot 2 cannot be 'tojson' (which takes no such query and just serializes to JSON). Likewise the trailing attribute must be 'value' to return the hashes, not 'tojson'. The automated key wrongly used 'tojson' for the filter slot, and the blind solver wrongly used 'tojson' for the final attribute; the correct completion is json_query(...).value.
Community Discussion