(input_string=None, split_input=None, delimiter=None, **kwargs)
return outputs
Decode one or more strings encoded with base64. The input can be a single chunk of base64 or a list of strings separated by a delimiter.
    
    Args:
        input_string (CEF type: *): Y2FsYy5leGU=
        split_input: Defaults to False. If True, use the delimiter to split the input string and decode each of the components separately if it is base64.
        delimiter: The character to use as a delimiter if split_input is True. Defaults to a comma. The special option "space" can be used to split on a single space character (" ").
    
    Returns a JSON-serializable object that implements the configured data paths:
        *.input_string (CEF type: *): Base64 string before being decoded
        *.output_string (CEF type: *): Resulting string after decoding from base64
Decode one or more strings encoded with base64. The input can be a single chunk of base64 or a list of strings separated by a delimiter.
    
    Args:
        input_string (CEF type: *): Y2FsYy5leGU=
        split_input: Defaults to False. If True, use the delimiter to split the input string and decode each of the components separately if it is base64.
        delimiter: The character to use as a delimiter if split_input is True. Defaults to a comma. The special option "space" can be used to split on a single space character (" ").
    
    Returns a JSON-serializable object that implements the configured data paths:
        *.input_string (CEF type: *): Base64 string before being decoded
        *.output_string (CEF type: *): Resulting string after decoding from base64
Decode one or more strings encoded with base64 . The input can be a single chunk of base64 or a list of strings separated by a delimiter . Args : input_string ( CEF type : * ) : Y2FsYy5leGU = split_input : Defaults to False . If True use the delimiter to split the input string and decode each of the components separately if it is base64 . delimiter : The character to use as a delimiter if split_input is True . Defaults to a comma . The special option space can be used to split on a single space character ( ) . Returns a JSON - serializable object that implements the configured data paths : * . input_string ( CEF type : * ) : Base64 string before being decoded * . output_string ( CEF type : * ) : Resulting string after decoding from base64
def base64_decode(input_string=None, split_input=None, delimiter=None, **kwargs):
    """
    Decode one or more strings encoded with base64. The input can be a single chunk of base64 or a list of strings separated by a delimiter.
    
    Args:
        input_string (CEF type: *): Y2FsYy5leGU=
        split_input: Defaults to False. If True, use the delimiter to split the input string and decode each of the components separately if it is base64.
        delimiter: The character to use as a delimiter if split_input is True. Defaults to a comma. The special option "space" can be used to split on a single space character (" ").
    
    Returns a JSON-serializable object that implements the configured data paths:
        *.input_string (CEF type: *): Base64 string before being decoded
        *.output_string (CEF type: *): Resulting string after decoding from base64
    """
    ############################ Custom Code Goes Below This Line #################################
    import json
    import phantom.rules as phantom
    import base64

    if not input_string or not isinstance(input_string, str):
        raise ValueError('input_string must be a string')

    def isBase64(sb):
        try:
            if isinstance(sb, str):
                # If there's any unicode here, an exception will be thrown and the function will return false
                sb_bytes = bytes(sb, 'ascii')
            elif isinstance(sb, bytes):
                sb_bytes = sb
            else:
                raise ValueError("Argument must be string or bytes")
            return base64.b64encode(base64.b64decode(sb_bytes)) == sb_bytes
        except Exception:
            return False
    
    outputs = []
    
    # split_input defaults to false
    if split_input == True or (isinstance(split_input, str) and split_input.lower() == 'true'):
        split_input = True
    else:
        split_input = False
        
    # create the list of inputs, whether it be the single input or a delimiter-separated list
    if not split_input:
        input_list = [input_string]
    else:
        if not isinstance(delimiter, str):
            delimiter = ','
        if delimiter == 'space':
            delimiter = ' '
        input_list = input_string.split(delimiter)
    
    # now that input_list is set up, perform the base64 decode on each item that is valid base64
    for index, value in enumerate(input_list):         
        if isBase64(value):
            try:
                value_bytes = value.encode('ascii')
                data = base64.b64decode(value_bytes, validate=True)
                if data:
                    outputs.append({'input_string': value, 'output_string': data.decode('ascii').replace('\x00','')})

            except Exception as e:
                phantom.error(f'Unable to decode string: {e}')

    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
    return outputs
def base64_decode ( input_string = None , split_input = None , delimiter = None , * * kwargs ) : ############################ Custom Code Goes Below This Line ################################# import json import phantom . rules as phantom import base64 if not input_string or not isinstance ( input_string , str ) : raise ValueError ( 'input_string must be a string' ) def isBase64 ( sb ) : try : if isinstance ( sb , str ) : # If there's any unicode here, an exception will be thrown and the function will return false sb_bytes = bytes ( sb , 'ascii' ) elif isinstance ( sb , bytes ) : sb_bytes = sb else : raise ValueError ( "Argument must be string or bytes" ) return base64 . b64encode ( base64 . b64decode ( sb_bytes ) ) == sb_bytes except Exception : return False outputs = [ ] # split_input defaults to false if split_input == True or ( isinstance ( split_input , str ) and split_input . lower ( ) == 'true' ) : split_input = True else : split_input = False # create the list of inputs, whether it be the single input or a delimiter-separated list if not split_input : input_list = [ input_string ] else : if not isinstance ( delimiter , str ) : delimiter = ',' if delimiter == 'space' : delimiter = ' ' input_list = input_string . split ( delimiter ) # now that input_list is set up, perform the base64 decode on each item that is valid base64 for index , value in enumerate ( input_list ) : if isBase64 ( value ) : try : value_bytes = value . encode ( 'ascii' ) data = base64 . b64decode ( value_bytes , validate = True ) if data : outputs . append ( { 'input_string' : value , 'output_string' : data . decode ( 'ascii' ) . replace ( '\x00' , '' ) } ) except Exception as e : phantom . error ( f'Unable to decode string: {e}' ) assert json . dumps ( outputs ) # Will raise an exception if the :outputs: object is not JSON-serializable return outputs