Component parameters and node execution flow

Parameter categories

Parameters fall into two classification dimensions:

• By role: playbook input parameters, playbook output parameters, component action input parameters, and component action output parameters.

• By source: system parameters and component parameters.

Component (node) input and output parameters

A node's input can be a fixed (constant) value or the output of an upstream node. To reference an upstream node's output, that node must appear before the current node on the same orchestration path.

The following diagram illustrates the rule. Node B can access the outputs of Node A (a direct upstream) and the playbook's input parameters. It cannot access Node D (a different branch) or Node C (not a preceding node of Node B on any path).

System parameters

Parameter formats

Node input parameters support three basic formats — constants, variables, and expressions — and any combination of them.

{
  "datalist": [
    {
      "person": {
        "weight": "120",
        "age": "12"
      }
    },
    {
      "person": {
        "weight": "121",
        "age": "13"
      }
    }
  ],
  "total_data_successful": 2,
  "total_data": 2,
  "total_exe_successful": 2,
  "total_exe": 2,
  "total_data_with_dup": 2,
  "status": true
}

Data type conversion

During playbook execution, most data is handled as strings. When an action requires a specific type, use ${data_type:data} to convert.

Examples:

JSONObject examples: Playbook input: {"src_ip":"127.0.0.1","dst_ip":"127.0.0.2","msg":"hello"}

JSONArray examples: Playbook input: {"datalist":[{"src_ip":"127.0.0.1","dst_ip":"127.1.0.1","msg":"hello"},{"src_ip":"127.1.0.1","dst_ip":"127.1.0.1","msg":"hello"}]}

Parameter processing and node execution flow

1. Node parameter extraction: After all required upstream nodes finish executing, the system extracts the current node's actual input data based on its input configuration. The extraction process is described in detail below.

2. Node execution: After the node's input parameters are assembled, the system deduplicates identical parameter sets and then executes the component action.

   Note

   When an action accepts multiple sets of parameter values, the action runs multiple times automatically.

   For example, to run the "Purge Malicious File" action on all servers of a compromised application (multiple servers), set the Server IP parameter to ${node1.datalist.*.ip}. The system automatically runs the action on each IP address without requiring a loop.

3. Output result aggregation and deduplication: After the node runs multiple times, the system aggregates and automatically deduplicates the results. An entry is considered a duplicate when all fields are identical.

   Before deduplication:

   [
       {
           "a":"11",
           "b":"22"
       },
       {
           "a":"11",
           "b":"22"
       },
       {
           "a":"11",
           "b":"33"
       }
   ]

   After deduplication:

   [
       {
           "a":"11",
           "b":"22"
       },
       {
           "a":"11",
           "b":"33"
       }
   ]

Parameter extraction process

Single data source

A complex JSON structure of any depth can be viewed as a tree. The principles for extracting parameters from JSON are: sibling relationships at the same depth are preserved, ancestor nodes are expanded, and fields that are neither siblings nor ancestors form a Cartesian product.

1. Automatically extracts data at any depth. Example:

   

2. Sibling relationships are preserved: Fields at the same level in the JSON structure remain paired.

   

3. Ancestor nodes are expanded: When a parent node has multiple children, it expands to match the child count.

   

4. Non-sibling, non-ancestor nodes form a Cartesian product: When two fields have no sibling or ancestor relationship, every combination is produced.

   

Multiple data sources

Apply a Cartesian product to the extraction results of each individual data source.