Storage Node
A storage node stores static or dynamic data to utilize in other nodes of a Playbook as input data.
You can add and configure the following storage nodes:
Memory Node
The memory node stores static or dynamic values that you can use in other nodes of the Playbook. You can use the dynamic path to fetch the values stored in the memory node and use them in any other node of the playbook. For more information, see Use Dynamic Paths.
For example, you can configure a memory node to store a list of threat indicators.
Sample Process
Steps
To configure a memory node, follow these steps:
From the Nodes list, drag and drop the Memory node to the canvas.
In the Node Details tab, configure the following node details:
In Basic Details, enter the following details:
Node Title: Enter a title for the node.
Description: Add a brief description of the node. It is recommended to add a relevant description for the node, as analysts can use this for their reference.
Abort playbook if this node fails: Select this option to terminate the playbook if the node fails to execute.
In Input Data, enter a static or dynamic key-value pair to store the data in the node. For example, you can store a list of IP addresses for threat enrichment.
Generate Dynamic Path: Generate a dynamic path using response parameters from other nodes. Click {} (curly braces) in the Value field and select relevant options for the following fields:
Nodes: Select a node type, such as App Action, Playbook, Input, and Memory, to generate the dynamic path.
Note
If the action node is selected, the default instance is used to generate the dynamic path.
Node: Select a node using the dropdown to generate a dynamic path.
Response Keys: Select the response key to retrieve values from the selected node.
Note
If you have selected an app action node and configured a custom output for it, you’ll be able to choose from the defined keys.
Preview: View the dynamic path generated based on the options selected for Node, Response Key, and other fields before adding it as Input Data.
To add the dynamic path in the Input Data, click Add. The values for the dynamic path will be retrieved automatically during the playbook execution.
To add more parameters, click Add Parameter.
Click Save.
Persistent Node
A persistent node is used to automatically update the value of a key-value pair in a persistent list or add new key-value pairs to a persistent list. For more information on the persistent list, see Persistent List.
Sample Process
Steps
To configure a persistent node, follow these steps:
From the Nodes list, drag and drop the Persistent node to the canvas.
To add other nodes from a specific node, select the node and click
. You can drag and drop any node type to connect from the selected node.In the Node Details tab, configure the following node details:
In Basic Details, enter the following details:
Node Title: Enter a title for the node.
Description: Add a brief description of the node. It is recommended to add a relevant description for the node as analysts can use this for their reference.
Abort playbook if this node fails: Select this option to terminate the playbook if the node fails to execute.
In Node Parameters, enter the dynamic path expression in the Key or Value field to perform an action to the persistent list.
Generate Dynamic Path: Generate a dynamic path using the response parameters from other nodes. Click {} (curly braces) in the Value field and enter the following details:
Nodes: Select a node, such as App Action, Playbook, Input, and Memory, to generate the dynamic path.
App Instances: Select the app instance for the action. It will be used to retrieve values for the selected keys. This field is only available when you select the App Action node.
Response Keys: Select the response key to retrieve values from the selected node.
Preview: View the generated dynamic path before adding it. The dynamic path is generated based on the options you have selected for Node, Response Key, and more.
Click Add to add the dynamic path to the field. The values will be retrieved automatically during the playbook execution.
To add more persistent lists, click + Persistent List.
You can perform the following actions using a persistent node:
Note
The Key field in Node Parameters of a persistent node accepts only a dynamic path related to a persistent list.
The name of a persistent list created using Create a Persistent List may contain uppercase characters and spaces. You must enter the slug name of a persistent list in the key or value field of a Playbook or Playbook node. You can type ${persistent-list:: to get auto suggestions for persistent lists to choose from, and then select a persistent list to autofill a slug name for a persistent list.
Click Save.