Using Loop Steps as a part of a workflow is a great way to iterate over and perform actions against each value that is contained within an array being passed through the workflow. Using the outputs from that loop later in your workflow may be difficult though, either requiring a Python Plugin or some fairly in depth handlebars within an Artifact Step. To make accessing and using the outputs from loops easier, we are happy to announce a new type of Loop Output!
These new Loop Step outputs should simplify your workflows by enabling you to:
- Make one decision based on many results
- Process data into a new format
- Count or add things up based on criteria
Let’s take a look at how it works with a couple of examples!
The Workflow
Starting with a fairly simple workflow that has a trigger which passes in an array of URLs that need to be enriched with some threat intelligence (the use case would be very similar if these URLs were coming from any step within the workflow), we will add in a Loop Step to iterate over that URL array.
Loop Configuration
Inside of our loop, we can then add a step to look up the URL in VirusTotal.
VirusTotal Step
Configuring The Outputs
Now by clicking on the new “Configure Loop” button in the top right corner of the workflow builder, I am brought to a new menu that allows me to add outputs. For each output, I can choose a name and the type of output that I would like to create.
Custom Output Configuration
I will create 4 different outputs from my loop to show some different possibilities:
Setting a boolean to true if any URLs have at least one positive
Creating a new array with each URL that has at least one positive
Summing the total positives for each URL
Adding to a counter for each URL with at least one positive
Using The Outputs
I have my outputs configured, now how do I use them later in the workflow? The good news is, just like any other variable!
For example, I could add an Automated Decision Step to check the boolean that I created. This would enable you to easily add is some containment or alerting actions if at least one of the URLs passed into the workflow is seen as malicious.
Using the loop output in a decision
I hope you can give these new Loop Outputs a try! Please let us know what you think and share other use cases this could help with in the comments.