Configuring a Variable Node

Variable nodes within a Workflow allow you to dynamically create, manipulate, and store data. This data is stored in the Workflow Data repository, making it available for use across other node configurations.
When you add a Variable node to a Workflow, a Write to data repository node is automatically added and the Write to Workflow Data pane opens. This pane is where you create new variables and update existing ones.

Variable nodes offer significant benefits for your Workflows:

• Define new variables or update existing ones, letting you store and manage values directly within your Workflow. You can even write to multiple variables within the same node using tabs.

• Use information from or write information to the repository without relying on external events or actions in the Workflow. This provides greater flexibility.

• A Workflow run can overwrite a previous run. Saving data to a variable lets you capture and reuse specific values from a run at a later time, regardless of the asset's path.

• Enhanced Workflow Capabilities:

  • Compose structured reports by collecting and organizing data.
  • Save sub-workflow node data for future reference.
  • Create a unified result variable when conditional paths generate multiple outcome

Defining or Updating Variables

The Write to Workflow Data pane opens automatically when you add a Write to data repository (Variable) node. A helpful banner appears on top of the page. Learn how to hide this banner.
From the Write to Workflow Data pane, follow the steps below.

To define or update Variables

1. By default, the Variables are defined on the asset retrieved from the previous node. If you want to use a different asset, select the input on which to define the variables.

2. Define and configure a new variable or select an existing variable to update.

3. Define the variable value using the Wizard or Syntax tab.

4. If the added or updated variable is valid, meaning that it has a valid name, field type, and value type, it appears in the Variables tab of the Workflow Data repository under its node's UUID. It is now ready for use by subsequent nodes in the Workflow.
   

   • If a Variable is defined in multiple nodes, the Variables tab of the Workflow Data repository shows the UUIDs of all nodes that the variable is defined in. The variable's value is the one from the latest node or the one from the taken path.
   • If a Variable configuration is not valid, its tab turns red and it isn't added to the Workflow Data repository. Correct the configuration to proceed.

5. If desired, select an additional existing or new variable. To do so, at the end of the line with the variable tabs, click the Add Variable icon +. A New variable tab opens. Repeat this procedure from the beginning.

   • If there isn't enough room to display all tabs, clicking the More icon shows a list of the overflow tabs.

Selecting the Input on Which to Define the Variables

The Variable node, by default, defines the variable on the asset retrieved from the previous node.

You can choose a different input asset using a query or a resolved asset from a prior node.

To select an asset on which to define the variable

1. Next to Retrieved, click the Edit Asset pencil icon (see screen above).

2. Choose one of the following options for the input asset:

   • A resolved asset from any previous node in the Workflow.
   • The first asset that meets the criteria of a Query.
   • The asset(s) resolved from the previous node (the default).

3. Click Apply.

4. If subsequent nodes exist in the Workflow path, a warning message appears, indicating that the asset change will propagate. Click Change Asset to confirm. The new asset's name is preceded by 'Custom'.

Selecting Asset from Previous Nodes

Workflow data, including resolved assets, is stored in the Workflow Data repository. Resolved assets are identified by their node UUID and asset type:

• Event[node UUID].<asset type> (for events)
• Action[node UUID].<asset type> (for actions)
• Variable[node UUID].<asset type> (for variables)
• Artifact[node UUID].<asset type> (for artifacts)

To select a resolved asset

1. From the Run action on resolved assets from previous nodes dropdown (open by default; if not, click Select Resolved Assets From Previous Nodes), select the desired asset.
   • Example: You can choose to define the variable on the first User asset from a previous Event node or a Vulnerability asset from a previous Action node.
     

Selecting First Asset Resulting From a Query

You can define the variable on the first asset returned by a query. The Workflow runs once per asset, and then proceeds to the next node.

To select assets using the Query Wizard

1. Open the Query Wizard by clicking Select Asset Using the Query Wizard.
2. Under Run action on assets that match the query, from the Module dropdown, select an asset type.
3. Configure your query using the Query Wizard that opens. In the Field Value box, you can type a value or copy a field value from the Workflow Data repository.

Resetting Input to Default Asset

You can always revert the asset on which the Variables are defined to the default (the one retrieved from the previous node in the Workflow).

To reset the asset to the default

• Click Reset to default from any tab. This reset applies to the current node and all subsequent nodes in the same path.

Defining a New Variable

To create a new Variable for your Workflow on the Write to data repository (Variable) node, you must define its name, field type, value type, and value.

To define a new variable

1. In Variable name, type a name for the new variable, following these rules:
   * Length: 3 to 50 characters.
   * Letters: a-z (lowercase only)
   * Numbers: 0-9 (cannot be the first character)
   * Underscores: _ (cannot be consecutive __ or placed at the start/end of the variable name)
   * No spaces or special characters: (!@#$%^&*()-+=[]{}|;:'",<>?/)
   * Unique: Variable names must be unique within the workflow.
2. From the dropdown, click + New field name.
   • The New variable tab name updates to the new name.
   • If valid, the new variable appears under Variables Data in the Workflow Data repository and in the Write to data repository node. The node displays the first four variables configured and indicates the number of additional ones. Hovering over the number displays a list of the additional variables.
3. In Field type, select Single Value (the default) or Multiple Values.
   • For a Multiple Values field, the Append values if field exists checkbox appears.
     • Enabling this option appends new values to existing values.
     • Disabling this option overwrites existing values with new values.
4. In Value type, select String (the default), Date, Float, Integer, or Boolean.

Selecting an Existing Variable

You can update an existing variable by assigning it a new value. You cannot change its field type or value type.

To select an existing variable

1. In the Variable name dropdown, select the existing variable you want to update.
   • The New variable tab name changes to the selected variable's name.
   • The variable also appears in the Write to data repository node.

Defining the Variable Value

Configure the value of a new or existing Variable using the Wizard or Syntax tab. This lets you populate the variable with Custom Input, Field Value, or Workflow Data repository (memory bank) data.
You define the Variable value similar to how you create a Dynamic Value Statement, with the following exceptions:

• The Action form field is not selectable; its value is Variable.
• There is no Simulate button to test the variable definition statement.

To define the Variable value

1. Click the Settings icon next to Define the variable value.
2. In the Settings that open, enable (the default) or disable Ignore empty values on asset fields.
   
3. Set the variable value from the Syntax tab (using autocomplete and the Syntax Helper) or the Wizard tab. You can click Validate to check your syntax.

Syntax Examples:

• All statement:

device all then form.variable_value set_value <Custom Input/Field Value/Operators>

• Switch case statement:

Switch [Field] 

case starts_with ("a") then form.variable_value set_value "A Group"

case starts_with ("b") then form.variable_value set_value "B Group"  

Hiding the Banner

When you add a Variable node to the Workflow, the Write to Workflow Data pane opens with a banner displayed on top of the page. You can hide the banner temporarily or permanently.

To hide the banner

1. Click the X on the right of the banner.
2. In the menu that opens, choose one of the following:
   • Close banner - Hides the banner now, but it reappears next time the pane opens.
   • Hide this banner permanently - Hides the banner indefinitley.

Deleting a Variable

You can remove a variable directly from the Write to data repository (Variable) node.

To delete a variable

• In the Write to Workflow Data pane, click the Remove icon x to the right of the tab of the variable you want to delete.
  The tab is removed from the Variable node and from the Variable data in the Workflow Data repository.

Deleting the Write to Data Repository Node

You can remove from the Workflow a Write to data repository node, with or without its child nodes.

To delete a Write to data repository (with or without its child nodes) from the Workflow

1. In the Workflow, click the node that you want to delete.
2. In the header of the Write to Workflow Data pane, click the Trashcan icon.
3. If the node has child nodes, a Remove Step confirmation dialog opens. Choose one of the following:
   • Clear the Remove node with all of its child nodes checkbox to remove only this action.
   • Select the Remove node with all of its child nodes checkbox to remove this action and the entire Workflow path below it.