filter component-Security Center(Security Center)-阿里云帮助中心

Actions

Action	Description	Scenarios
filter	Filters data from a specific node.	Filters data from a specific node to select records that match the rules.

Configuration example

This topic provides configuration examples for filter component actions. You can import them as test playbooks into the visual flow editor to explore and test configuration parameters. For import steps, see Playbook import.

Note

Save the sample data as a JSON file before importing it into the editor.

Sample data

{
    "cells": [
        {
            "position": {
                "x": -770,
                "y": -170
            },
            "size": {
                "width": 36,
                "height": 36
            },
            "attrs": {
                "body": {
                    "fill": "white",
                    "strokeOpacity": 0.95,
                    "stroke": "#63ba4d",
                    "strokeWidth": 2
                },
                "label": {
                    "text": "start",
                    "fontSize": 12,
                    "refX": 0.5,
                    "refY": "100%",
                    "refY2": 4,
                    "textAnchor": "middle",
                    "textVerticalAnchor": "top"
                },
                "path": {
                    "stroke": "#63ba4d"
                }
            },
            "visible": true,
            "shape": "circle",
            "id": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4",
            "zIndex": 1,
            "data": {
                "nodeType": "startEvent",
                "appType": "basic",
                "nodeName": "start",
                "icon": "icon-circle",
                "description": "Playbook start node. A playbook must have one and only one start node, which requires input data configuration for the playbook."
            },
            "markup": [
                {
                    "tagName": "circle",
                    "selector": "body"
                },
                {
                    "tagName": "text",
                    "selector": "label"
                }
            ],
            "isNode": true
        },
        {
            "shape": "custom-edge",
            "attrs": {
                "line": {
                    "stroke": "#63ba4d",
                    "targetMarker": {
                        "stroke": "#63ba4d"
                    }
                }
            },
            "zIndex": 1,
            "id": "5293c3f9-e1c9-4a49-b0eb-635067dc67e8",
            "data": {
                "nodeType": "sequenceFlow",
                "appType": "basic",
                "isRequired": true,
                "icon": "icon-upper-right-arrow"
            },
            "isNode": false,
            "source": {
                "cell": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4"
            },
            "target": {
                "cell": "c1b02b5a-b343-48c9-8e17-984abf6965ed"
            },
            "visible": true,
            "router": {
                "name": "manhattan",
                "args": {
                    "padding": 5,
                    "excludeHiddenNodes": true,
                    "excludeNodes": [
                        "clone_node_id"
                    ]
                }
            },
            "vertices": [

            ]
        },
        {
            "position": {
                "x": 80,
                "y": -170
            },
            "size": {
                "width": 36,
                "height": 36
            },
            "attrs": {
                "body": {
                    "fill": "white",
                    "strokeOpacity": 0.95,
                    "stroke": "#63ba4d",
                    "strokeWidth": 2
                },
                "path": {
                    "r": 12,
                    "refX": "50%",
                    "refY": "50%",
                    "fill": "#63ba4d",
                    "strokeOpacity": 0.95,
                    "stroke": "#63ba4d",
                    "strokeWidth": 4
                },
                "label": {
                    "text": "end",
                    "fontSize": 12,
                    "refX": 0.5,
                    "refY": "100%",
                    "refY2": 4,
                    "textAnchor": "middle",
                    "textVerticalAnchor": "top"
                }
            },
            "visible": true,
            "shape": "circle",
            "id": "317dd1be-2d20-460e-977e-1fc936ffb583",
            "zIndex": 1,
            "data": {
                "nodeType": "endEvent",
                "appType": "basic",
                "nodeName": "end",
                "icon": "icon-radio-off-full",
                "description": "end"
            },
            "markup": [
                {
                    "tagName": "circle",
                    "selector": "body"
                },
                {
                    "tagName": "circle",
                    "selector": "path"
                },
                {
                    "tagName": "text",
                    "selector": "label"
                }
            ],
            "isNode": true
        },
        {
            "position": {
                "x": -380,
                "y": -185
            },
            "size": {
                "width": 137,
                "height": 66
            },
            "view": "react-shape-view",
            "attrs": {
                "label": {
                    "text": "filter"
                }
            },
            "shape": "activity",
            "id": "41ac8fbf-0390-4b1c-9d44-b91150a607a3",
            "data": {
                "componentName": "filter",
                "appType": "component",
                "nodeType": "action",
                "icon": "https://img.alicdn.com/imgextra/i3/O1CN01zYP1Bk1msd4DgMiBa_!!6000000005010-55-tps-22-22.svg",
                "ownType": "sys",
                "zIndex": 1,
                "customInput": false,
                "operateType": "general",
                "name": "filter",
                "nodeName": "filter",
                "actionName": "filter",
                "actionDisplayName": "filter",
                "cascaderValue": [
                    {
                        "label": "DataFormat",
                        "value": "${DataFormat}",
                        "children": [
                            {
                                "label": "DataFormat.total_data_with_dup",
                                "name": "DataFormat.total_data_with_dup",
                                "value": "${DataFormat.total_data_with_dup}"
                            },
                            {
                                "label": "DataFormat.datalist.*.name",
                                "name": "DataFormat.datalist.*.name",
                                "value": "${DataFormat.datalist.*.name}"
                            },
                            {
                                "label": "DataFormat.total_exe_successful",
                                "name": "DataFormat.total_exe_successful",
                                "value": "${DataFormat.total_exe_successful}"
                            },
                            {
                                "label": "DataFormat.total_data",
                                "name": "DataFormat.total_data",
                                "value": "${DataFormat.total_data}"
                            },
                            {
                                "label": "DataFormat.total_exe",
                                "name": "DataFormat.total_exe",
                                "value": "${DataFormat.total_exe}"
                            },
                            {
                                "label": "DataFormat.status",
                                "name": "DataFormat.status",
                                "value": "${DataFormat.status}"
                            },
                            {
                                "label": "DataFormat.total_data_successful",
                                "name": "DataFormat.total_data_successful",
                                "value": "${DataFormat.total_data_successful}"
                            }
                        ]
                    }
                ],
                "valueData": {
                    "upstreamNode": "DataFormat",
                    "condition": "{\"condition\":\"AND\",\"rules\":[{\"field\":\"${DataFormat.datalist.*.name}\",\"value\":[\"test1\"],\"match\":\"is\",\"type\":\"string\",\"valueSource\":\"value\"}]}"
                },
                "status": "success"
            },
            "zIndex": 1
        },
        {
            "shape": "custom-edge",
            "attrs": {
                "line": {
                    "stroke": "#63ba4d",
                    "targetMarker": {
                        "stroke": "#63ba4d"
                    }
                }
            },
            "zIndex": 1,
            "id": "3e5126c8-61ce-4582-9fcd-49e3fca844ea",
            "data": {
                "nodeType": "sequenceFlow",
                "appType": "basic",
                "isRequired": true,
                "icon": "icon-upper-right-arrow"
            },
            "isNode": false,
            "visible": true,
            "router": {
                "name": "manhattan",
                "args": {
                    "padding": 5,
                    "excludeHiddenNodes": true,
                    "excludeNodes": [
                        "clone_node_id"
                    ]
                }
            },
            "source": {
                "cell": "41ac8fbf-0390-4b1c-9d44-b91150a607a3"
            },
            "target": {
                "cell": "437f1a16-609f-40d9-9ac8-5d9bd8aeafcd"
            },
            "vertices": [

            ]
        },
        {
            "position": {
                "x": -165,
                "y": -185
            },
            "size": {
                "width": 137,
                "height": 66
            },
            "view": "react-shape-view",
            "attrs": {
                "label": {
                    "text": "DataFormat_2"
                }
            },
            "shape": "activity",
            "id": "437f1a16-609f-40d9-9ac8-5d9bd8aeafcd",
            "data": {
                "componentName": "DataFormat",
                "appType": "component",
                "nodeType": "action",
                "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745654600&OSSAccessKeyId=STS. NXW5************&Signature=j5SXLh%2Fw5b4PhkhzWa%2FWgl%2BGWRQ%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5vifvv6269M2bWOYV%2FojmsWNLhPgrXsiTz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb40Y6HzyK0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2Bo58zxrcUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU4J6tvBMytAXxqAAYb6jxZjLe7TMmktKoKJDPNYGnTAeViZJKpduCT2k7DBuEUN%2B%2B8fsvmMKsLLycLOYmqBqU%2FB4%2Fdy5Muz%2B6WDAQFoEDgzB17wouEZsoQG5EoCHljEH6DBajdzaAaISFedQrIaeBqEJIrLqLMKQlSqas3HEp8VqOaseKoWLb5PDxTGIAA%3D",
                "ownType": "sys",
                "zIndex": 1,
                "tenantId": "baba",
                "customInput": false,
                "description": "Generate new data",
                "id": 0,
                "name": "formatdata",
                "operateType": "general",
                "output": [

                ],
                "parameters": [
                    {
                        "dataType": "Complex",
                        "defaultValue": "",
                        "description": "Data to be transformed and generated",
                        "enDescription": "",
                        "name": "outputFields",
                        "needCascader": false,
                        "required": false,
                        "tags": ""
                    }
                ],
                "riskLevel": 2,
                "nodeName": "DataFormat_2",
                "actionName": "formatdata",
                "actionDisplayName": "formatdata",
                "cascaderValue": [
                    {
                        "label": "filter_1",
                        "value": "${filter_1}",
                        "children": [
                            {
                                "label": "filter_1.failedReason",
                                "name": "filter_1.failedReason",
                                "value": "${filter_1.failedReason}"
                            },
                            {
                                "label": "filter_1.total_exe_successful",
                                "name": "filter_1.total_exe_successful",
                                "value": "${filter_1.total_exe_successful}"
                            },
                            {
                                "label": "filter_1.status",
                                "name": "filter_1.status",
                                "value": "${filter_1.status}"
                            },
                            {
                                "label": "filter_1.filter_total_data_successful",
                                "name": "filter_1.filter_total_data_successful",
                                "value": "${filter_1.filter_total_data_successful}"
                            },
                            {
                                "label": "filter_1.total_data_successful",
                                "name": "filter_1.total_data_successful",
                                "value": "${filter_1.total_data_successful}"
                            },
                            {
                                "label": "filter_1.total_data_with_dup",
                                "name": "filter_1.total_data_with_dup",
                                "value": "${filter_1.total_data_with_dup}"
                            },
                            {
                                "label": "filter_1.filter_total_data",
                                "name": "filter_1.filter_total_data",
                                "value": "${filter_1.filter_total_data}"
                            },
                            {
                                "label": "filter_1.total_data",
                                "name": "filter_1.total_data",
                                "value": "${filter_1.total_data}"
                            },
                            {
                                "label": "filter_1.total_exe",
                                "name": "filter_1.total_exe",
                                "value": "${filter_1.total_exe}"
                            }
                        ]
                    },
                    {
                        "label": "DataFormat",
                        "value": "${DataFormat}",
                        "children": [

                        ]
                    }
                ],
                "valueData": {
                    "outputFields": "[{\"fieldName\":\"name\",\"fieldValue\":\"${filter.datalist.*.name}\"}]"
                },
                "status": "success"
            },
            "zIndex": 1
        },
        {
            "shape": "custom-edge",
            "attrs": {
                "line": {
                    "stroke": "#63ba4d",
                    "targetMarker": {
                        "stroke": "#63ba4d"
                    }
                }
            },
            "zIndex": 1,
            "id": "b299b622-6607-4284-b05d-aa8339eee601",
            "data": {
                "nodeType": "sequenceFlow",
                "appType": "basic",
                "isRequired": true,
                "icon": "icon-upper-right-arrow"
            },
            "isNode": false,
            "visible": true,
            "router": {
                "name": "manhattan",
                "args": {
                    "padding": 5,
                    "excludeHiddenNodes": true,
                    "excludeNodes": [
                        "clone_node_id"
                    ]
                }
            },
            "source": {
                "cell": "437f1a16-609f-40d9-9ac8-5d9bd8aeafcd"
            },
            "target": {
                "cell": "317dd1be-2d20-460e-977e-1fc936ffb583"
            },
            "vertices": [

            ]
        },
        {
            "position": {
                "x": -610,
                "y": -190
            },
            "size": {
                "width": 137,
                "height": 66
            },
            "view": "react-shape-view",
            "attrs": {
                "label": {
                    "text": "DataFormat"
                }
            },
            "shape": "activity",
            "id": "c1b02b5a-b343-48c9-8e17-984abf6965ed",
            "data": {
                "componentName": "DataFormat",
                "appType": "component",
                "nodeType": "action",
                "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745654600&OSSAccessKeyId=STS. NXW5************&Signature=j5SXLh%2Fw5b4PhkhzWa%2FWgl%2BGWRQ%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5vifvv6269M2bWOYV%2FojmsWNLhPgrXsiTz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb40Y6HzyK0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2Bo58zxrcUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU4J6tvBMytAXxqAAYb6jxZjLe7TMmktKoKJDPNYGnTAeViZJKpduCT2k7DBuEUN%2B%2B8fsvmMKsLLycLOYmqBqU%2FB4%2Fdy5Muz%2B6WDAQFoEDgzB17wouEZsoQG5EoCHljEH6DBajdzaAaISFedQrIaeBqEJIrLqLMKQlSqas3HEp8VqOaseKoWLb5PDxTGIAA%3D",
                "ownType": "sys",
                "zIndex": 1,
                "tenantId": "baba",
                "customInput": false,
                "description": "Convert input data to JSON type. If it is a JSONArray, all arrays are placed directly in the datalist. If it is a JSONObject, it is treated as a row of data in the datalist",
                "id": 0,
                "name": "convertToJSON",
                "operateType": "general",
                "parameters": [
                    {
                        "dataType": "Text",
                        "defaultValue": "",
                        "description": "Input data",
                        "name": "inputData",
                        "needCascader": false,
                        "required": false
                    }
                ],
                "riskLevel": 2,
                "nodeName": "DataFormat",
                "actionName": "convertToJSON",
                "actionDisplayName": "convertToJSON",
                "cascaderValue": [

                ],
                "valueData": {
                    "inputData": "[{\"name\":\"test\"},{\"name\":\"test1\"}]"
                },
                "status": "success"
            },
            "zIndex": 1
        },
        {
            "shape": "custom-edge",
            "attrs": {
                "line": {
                    "stroke": "#63ba4d",
                    "targetMarker": {
                        "stroke": "#63ba4d"
                    }
                }
            },
            "zIndex": 1,
            "id": "d87ef9c5-9ce1-4a0a-81c3-5bbb1fc22c6a",
            "data": {
                "nodeType": "sequenceFlow",
                "appType": "basic",
                "isRequired": true,
                "icon": "icon-upper-right-arrow"
            },
            "isNode": false,
            "visible": true,
            "router": {
                "name": "manhattan",
                "args": {
                    "padding": 5,
                    "excludeHiddenNodes": true,
                    "excludeNodes": [
                        "clone_node_id"
                    ]
                }
            },
            "source": {
                "cell": "c1b02b5a-b343-48c9-8e17-984abf6965ed"
            },
            "target": {
                "cell": "41ac8fbf-0390-4b1c-9d44-b91150a607a3"
            },
            "vertices": [

            ]
        }
    ]
}

filter

Passes data that meets the conditions to the next node.

Parameters

Parameter	Description
Select Node	The node whose data is to be filtered.
Condition	Supports multiple combined conditions. Defaults to one condition group.

Condition configuration

SOAR provides a visual interface for configuring the condition rules of the filter component. The interface is described as follows:

Number	Description
1 - Logical operator	AND: All conditions must be met. OR: At least one of the conditions must be met. Important The logical operator only determines the logical relationship between rules within the same group.
2 - Negation switch	Negates the condition evaluation for the current group.
3 - Add rule to group	Adds a rule to the group. The logical relationship between multiple rules in a group is determined by the 1 - Logical operator in the top left corner.
4 - Add condition group	Adds a group of filter conditions. Important The relationship between different groups is always AND and is not affected by the 1 - Logical operator.
5 - Condition field	Supports expressions and constants, typically an output field from a preceding node.
6 - Condition judgment rule	Supports operations such as IN and = for strings (String), numbers (Number), and observation lists. For more information, see the documentation for the filter component.
7 - Condition value	Supports expressions and constants.

Condition rules

Rule	Description	Remarks
NOT IN IP Dataset	Not in the IP observation list.	Before you can select an observation list, you must first configure it in Security Center > Agentic SOC > Integration Center > Observation Lists.
IN IP Dataset	In the IP observation list.
NOT IN Dataset	Not in the observation list.
IN Dataset	In the observation list.
String\| equals	Checks if the string equals the specified value.	None
String\| not equal to	Checks if the string does not equal the specified value.	None
String\| contains	Checks if the string contains the specified value.	Example: 'abc' contains 'bc'.
String\| does not contain	Checks if the string does not contain the specified value.	Example: 'abc' does not contain 'd'.
String\| starts with	Checks if the string starts with the specified value.	Example: 'abc' starts with 'ab'.
String\| ends with	Checks if the string ends with the specified value.	Example: 'abc' ends with 'bc'.
String\| does not end with	Checks if the string does not end with the specified value.	Example: 'abc' does not end with 'ab'.
String\| regex match	Checks if the string matches the specified regular expression.	Example: 'abcabc' matches the regex '(abc)+'.
String\| not regex match	Checks if the string does not match the specified regular expression.	Example: 'abab' does not match the regex '(abc)+'.
String\| is empty	Checks if the string is empty.	Empty strings (''), null, and NULL are all considered empty.
String\| is not empty	Checks if the string is not empty.	None
Number\| equals	Checks if the number is equal to the specified value.	None
Number\| not equal to	Checks if the number is not equal to the specified value.	None
Number\| greater than	Checks if the number is greater than the specified value.	None
Number\| greater than or equal to	Checks if the number is greater than or equal to the specified value.	None
Number\| less than	Checks if the number is less than the specified value.	None
Number\| less than or equal to	Checks if the number is less than or equal to the specified value.	None
Number\| in range	Checks if the number falls within the configured range. Format: number,number.	Example: 1 is in the range -1,5.

Condition configuration example

The outer AND logic group contains two rules: field path ${node.datalist.*.age}, type Number, with operators greater than (>) and less than (<). The nested OR logic subgroup contains two rules: field path ${node.datalist.*.name}, type String, both using the equals (is) operator.

In the example above, the condition is met if the name field of the node is 'john' or 'alice' AND the age field is between 12 and 20 (inclusive).