Operators

Types of Operators

Operators are used to filter, loop or store data generated by a Trigger or an Action.

The list of Operators can be displayed by clicking on Operators in the library:

Condition

The Condition Operator is used to evaluate one or several expressions to check if they are true or false. It is similar to the If/Else If/Else conditions that you can find in programming. A Condition therefore allows conditional execution of your playbook based on the evaluation of these expressions.

To add a condition, it is needed to add a case, by clicking on the + button then Add form:

When you create a case, you need to configure it by filling the fields:

• Comparaison - The comparison element of your expression
• Left - the left part of your expression before the comparison element
• Right - the right part of your expression after the comparison element
• Name - Name of your case

Example:

In this exemple, a condition is created to check if the rule name that triggered the playbook - {{ node.1['rule']['name'] }} - is the SEKOIA Intelligence Feed rule.

Comparison types

This array shows the different types of comparison available with examples:

Comparison	Meaning	Exemple left	Exemple right	Additional information
==	Equal to	{{ node.1['rule']['name'] }}	SEKOIA Intelligence Feed
!=	Not equal to	{{ node.1['rule']['name'] }}	SEKOIA Intelligence Feed
<	Less than	{{ node.1['urgency']['current_value'] }}	{{ 80 }}	For number comparison, it is needed to transform the value as an "Integer" because it is interpreted as a String by default. For that the value is surrounded by curly brackets.
>	Greater than	{{ node.1['urgency']['current_value'] }}	{{ 80 }}	For number comparison, it is needed to transform the value as an "Integer" because it is interpreted as a String by default. For that the value is surrounded by curly brackets.
<=	Less than or equal to	{{ node.1['urgency']['current_value'] }}	{{ 80 }}	For number comparison, it is needed to transform the value as an "Integer" because it is interpreted as a String by default. For that the value is surrounded by curly brackets.
>=	Greater than or equal to	{{ node.1['urgency']['current_value'] }}	{{ 80 }}	For number comparison, it is needed to transform the value as an "Integer" because it is interpreted as a String by default. For that the value is surrounded by curly brackets.
in	Includes in	{{ node.1['rule']['name'] }}	["my rule 1", "my second rule", "my third rule"]
not in	Not includes in	{{ node.1['rule']['name'] }}	["my rule 1", "my second rule", "my third rule"]
range	In the range of	{{ node.1['urgency']['current_value'] }}	[{{10}}, {{100}}]	Edge values are included in the range

Foreach

The Operator Foreach is specialised in the browsing of a list of data.

To configure the Foreach, you need to fill the field Items corresponding of the list of data.

This Operator has two output branches:

• One called loop which will be executed for every item in the list.
• One that will be executed after the loop on the different items is finished.

The Foreach module has 3 outputs:

• node.X.default.value - The reference of the current item in the loop
• node.X.default.index - The number of iterations performed (starts at 0)
• node.X.default.total - The total number of items

For instance, if the Foreach is the node 3 and you want to get the reference of the current item in the loop, you can use {{node.3.default.value}}

Store

The Operator Store allows a user to store data in a step of a playbook and retrieve it in another module. A data is always associated to a key. To store an information, you have to create a modification by clicking on + then Add form.

To configure your modification, you need to fill 3 fields :

• key - The key will be used to retrieve the data in another module or to edit it in another store.
• type - The type correponds to the action you want to do.
• value - The value of the data.

Retrieve data from the store

To retrieve information from the store in a module, you need to specify the key associated to it.

Example:

To retrieve the list of IPs stored in the key ip: use {{ store.ip }}.

Types of store

4 types are available within a Store:

• set: to set a value for the specified key.
• unset: to unset the value of the specified key.
• append: to store the value in a list referenced by the key. If the list does not exist, it is created, otherwise the value is appended to it.
• remove: to remove a value from a list referenced by the key.

Access a key from a store in another module

To access a key from a store in another module: use {{ store.name_of_the_key }}.