JSONata

the jsonata connector enables the transformation and querying of json data using jsonata expressions within the swimlane platform jsonata is a lightweight query and transformation language for json data, enabling the extraction and manipulation of data from complex structures this connector allows swimlane turbine users to apply jsonata expressions directly within their security playbooks, transforming and querying data with ease by integrating jsonata, users can enhance their automation workflows, reduce manual data processing, and ensure consistent data formatting across different systems the connector's 'evaluate expression' action simplifies complex data operations, making it a powerful tool for security analysts who need to handle diverse data sets quickly and accurately setup the jsonata connector comes with one action, evaluate expression there are two inputs the expression to apply to the json data an empty object input to begin adding sub properties to for adding data to query the entry point for the data is the object input you may create sub properties of the correct type and map any playbook inputs, event properties, or upstream action outputs to them example you have a jsonata action with two upstream actions, action 1 and action 2 when configuring the jsonata action, you can add two sub properties to the object input to which the output of action 1 and action 2 can be mapped the data you have to query will then become { "object" { "property1" {"\<action 1 data>"}, "property2" {"\<action 2 data>"} } } this allows you to combine data into one object to query and transform so if action1 and action2 results are arrays, you can do something simple like expression = append(object property1, object property2) which would return a single array of the two added together output there is one output property for each type that the output could be string number boolean object numeric array string array object array only 1 output property will be returned for a single run of the action the output property that will be populated and returned is determined by the type of the return value of the jsonata expression examples jsonata return value output property containing result "a string" string 123 number true boolean \[1, 2, 3] numeric array \["a", "b", "c"] string array \[{"a" 1}, {"b" 2}] object array "123" string "true" string 12 3 number additional documentation jsonata has great documentation filled with tons of examples and a web app for testing expressions on json data which is recommended to use for development https //docs jsonata org/overview\ html https //try jsonata org/ actions evaluate expression transform and query data using a jsonata expression, with 'expression' as a required input input argument name type required description expression string required the jsonata expression to execute object object optional object input to transform or query input example {"object" {"swimlane" "soar"}} output parameter type description string string string response output number number number response output boolean boolean boolean response output object object object response output arraynumber array array with numeric items output arraystring array array with string items output arrayobject array array with object items output output example {"string" "string","number" 123,"boolean"\ true,"object" {},"arraynumber" \[],"arraystring" \[],"arrayobject" \[]} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt