Context Variables

context variables hold data about the current playbook run trigger payloads, playbook inputs, action results, assets, variables, and runtime metadata you use them in expressions to map inputs, build conditions, and transform data when to use context variables use context variables when you need to map data from a trigger into an action input (for example, $event data body email ) reference earlier action results (for example, $actions http request result body ) build conditional logic (for example, $actions lookup status == "success" ) use playbook inputs or variables at runtime (for example, $inputs customerid, $variables counter ) using context variables in expressions use dot notation to access properties and bracket notation for arrays or keys with special characters examples \# trigger data $event data body severity $event data headers\["x request id"] \# playbook inputs $inputs ticketid $inputs items\[0] id \# action results $actions enrich result ip $actions lookup status \# variables $variables retrycount $loop value where you can use expressions action inputs (static value, playbook property, or expression) conditions (flows, triggers, and retries) transformations and scripts finding the right names and paths use these spots in the ui to confirm the exact names and paths you should reference action outputs open the action outputs tab to see the output schema and property names see docid\ za4vtf 23wb1zyckgfn4v discovered outputs use discovered outputs when testing actions to capture runtime fields that aren't in the base schema see docid\ awyj8hbaihut1g37b7atu trigger schemas the trigger configuration defines the $event data structure for that trigger action names use the action name shown on the canvas as the \<name> in $actions \<name> context variable reference context variables description example $playbook the name of the playbook find iocs $inputs user defined schema of inputs for a playbook "$inputs" { "some string playbook input" "some string passed to the playbook" } $event data related to the sensor event that triggered the playbook webhook "$event" { "data" { "headers" { "x account id" "228edce1 be3e 4b45 99d5 b4a11ac41489", "x tenant id" "911b9bae 540e 4064 93dc 33c1364587dd", "host" "turbine webhook agent pool", "connection" "close", "authorization" "basic u3dpbwxhbmu6yxnk", "user agent" "postmanruntime/7 28 3", "accept" " / ", "cache control" "no cache", "postman token" "fc42206a 66a0 4649 9885 a16e00ab8e9d", "accept encoding" "gzip, deflate, br" }, "url" { "hostname" "turbine webhook agent pool", "href" "http //turbine webhook agent pool/v1/webhook/5e60bc88 5780 42a9 8026 329fd0060d55/triggers webhook am9pa", "ips" \[], "pathname" "/v1/webhook/5e60bc88 5780 42a9 8026 329fd0060d55/triggers webhook am9pa", "port" 80, "protocol" "http", "query" {} }, "method" "get" }, "post" {}, "type" "custom webhook", "action" "request", "fqn" "turbine custom webhook request", "timestamp" 1717444327944, "sensor" { "name" "triggers webhook am9pa", "tags" {} }, "agent" { "name" "webhook agent a966253ee5a4 f975040d f3e5 4a96 beec bd729605537e", "tags" {} }, "tags" {} }, $event data related to the sensor event that triggered the playbook record "$event" { "data" { "application" { "id" "axrvgak9ufrm86lop", "uid" "records testing 658c9", "name" "records testing" }, "currentuser" { "id" "a6d44865 ed5d 4b9a a29d d0d3302d5629", "username" " mailto\ swimlaneadmin\@swimlane com ", "issystemuser" false }, "record" { "id" "an1kk0cot6maprd0c", "url" "https //localhost 443/account/228edce1 be3e 4b45 99d5 b4a11ac41489/tenant/911b9bae 540e 4064 93dc 33c1364587dd/record/axrvgak9ufrm86lop/an1kk0cot6maprd0c", "values" { "text" "example", "multiline text" "multi line example", "radio buttons" "option 2", "numeric" 1, "tracking id" "ort 9", "first created" "2024 06 03t19 56 10 0259161z", "last updated" "2024 06 03t19 56 10 0606078z" } } }, "post" {}, "type" "record", "action" "create", "fqn" "turbine record create", "timestamp" 1717444570268, "sensor" { "name" "turbine", "tags" {} }, "agent" { "name" "sw api", "tags" {} }, "tags" {} } $event data related to the sensor event that triggered the playbook cron "$event" { "data" { "cron" " " }, "post" {}, "type" "schedule", "action" "cron", "fqn" "turbine schedule cron", "timestamp" 1717446660290, "sensor" { "name" "turbine", "tags" {} }, "agent" { "name" "engine local", "tags" {} }, "tags" {} } $event data related to the sensor event that triggered the playbook manual "$event" { "data" {}, "post" {}, "type" "playbook", "action" "executetest", "fqn" "turbine playbook executetest", "timestamp" 1717442522695, "sensor" { "name" "turbine", "tags" {} }, "agent" { "name" "api local dev", "tags" {} }, "tags" {} $event data data/inputs from the event $event post any data post processing from the trigger $event type type of event (events, sensors, schedules) $event action action of the event type $event fqn fully qualified event name $event timestamp integer timestamp of the event in milliseconds $event sensor name name of the sensor that received the event $event sensor tags tags associated with the sensor $event agent name name of the agent that was running the sensor $event agent tags tags associated with the agent $event tags tags associated with the event $trigger name the name of the trigger cron "$trigger" { "type" "schedules", "name" "cron" } $trigger name the name of the trigger webhook "$trigger" { "type" "sensors", "name" "triggers webhook acu1r" }, $trigger name the name of the trigger records "$trigger" { "type" "records", "name" "a6tgj create" }, $trigger name the name of the trigger manual "$trigger" { "type" "events", "name" "playbook executetest" } $trigger type the type of trigger (events, sensors, schedules) $actions object containing all preceding actions that led to the current action "$actions" { "some create variables action key name" { "result" { "string at7xg" "test", "number ajpro" 1, "boolean a7qe9" true, "object a4k88" { "string amul7" "" }, "array afhe7" \[ { "array agz7a" \[ "" ] } ], "attachment ah5dr" null, "iterable" \[ 1, 2, 0 ] }, "published" {}, "status" "success" }, "some http action key name" { "result" { "status code" 200, "headers" { "date" "mon, 03 jun 2024 20 08 02 gmt", "content type" "application/json; charset=utf 8", "content length" "2110", "connection" "close", "etag" "w/\\"83e hiaiudlaghvv/6xo4efajkfvwt0\\"", "set cookie" \[ "sails sid=s%3a6nn48ik2huvfuh99u38mgwqte3kfa9zb ebtiffsxekw%2fn8r1yme8yyz2vzjxsa7posv9hbfmaqk; path=/; httponly" ] }, "status reason" "ok", "body" { "args" { "test" "1", "{\\"block 1\\" {\\"text\\" \\"some text\\",\\"text 2\\" \\"more text\\",\\"text list\\" " { "\\"text1\\",\\"text2\\",\\"text3\\"" { "1,2 2,3 45, 4" { "\\"one\\",\\"three\\"" { "\\"option 1\\",\\"option 3\\"" { "\\"ort 4\\"" { "\[\\"ort 4\\",\\"ort 5\\"],\\"reference grid\\" \[\\"ort 4\\",\\"ort 5\\"]},\\"block 2\\" \[\\"text1\\",\\"text2\\",\\"text3\\"],\\"true\\"\ true}" "\[\\"text1\\",\\"text2\\",\\"text3\\"]" } } } } } } }, "headers" { "x forwarded proto" "https", "x forwarded port" "443", "host" "postman echo com", "x amzn trace id" "root=1 665e22a1 454ed58d1b586c896b75161a", "accept encoding" "gzip, deflate, br" }, "url" " https //postman echo com/get?xxxx " } }, "published" {}, "status" "success" }, "some loop action" { "result" \[ { "script ac4ft" { "result" { "string ano7f" "text1" } } }, { "script ac4ft" { "result" { "string ano7f" "text2" } } }, { "script ac4ft" { "result" { "string ano7f" "text3" } } } ], "published" {}, "status" "success" }, "$parent" { "published" {}, "status" "fail" }, "$current" { "result" { "actions" { "createvariables atysx" { "result" { "string awuwp" "asdf" }, "published" {}, "status" "success" } }, "published" {} }, "published" {}, "status" "success" }, "newcomponent az0s4" { "result" { "actions" { "createvariables atysx" { "result" { "string awuwp" "asdf" }, "published" {}, "status" "success" } }, "published" {} }, "published" {}, "status" "success" }, "7 script" { "result" {}, "published" {}, "status" "success" }, "condition aexis" { "result" "3", "published" {}, "status" "success" }, "transformation alag3" { "result" { "block 1" { "text" "some text", "text 2" "more text", "text list" \[ "text1", "text2", "text3" ], "email" " mailto\ ian schultz\@swimlane com ", "url" " https //swimlane com ", "rich text" "\<h3>header\</h3>", "multiline text" "multiline\ntext\ndata", "telephone" "123 345 5678", "ip" "127 0 0 1", "json" "{ \\"property1\\" \\"value 1\\", \\"property2\\" true }", "numeric" 123 4, "numeric list" \[ 1, 2 2, 3 45, 4 ], "single select" "value 2", "multi select" \[ "one", "three" ], "radio buttons" "option 2", "checkboxes" \[ "option 1", "option 3" ], "date time" "2023 11 20t10 45 03z", "date" "2023 11 20", "timespan" "123456789", "time" "10 45 03", "usergroups" "swimlaneadmin", "reference single" \[ "ort 4" ], "reference multi" \[ "ort 4", "ort 5" ], "reference grid" \[ "ort 4", "ort 5" ] }, "block 2" \[ "text1", "text2", "text3" ], "true" true }, "published" {}, "status" "success" } }, $actions \<name> result result of the specified action $actions \<name> post posted values from the specified action $actions \<name> status status of the specified action $actions $current result result of the current action (not populated until the action has run) $actions $current post posted values from the current action (not populated until the action has run) $actions $parent result result of the previous action $actions $parent post posted values from the previous action $assets object of asset names and their respective parameters "$assets" { "vt asset" { "url" " https //www virustotal com ", "x apikey" "xxx", }, $published the current published object needed when mapping an output to an application record or to use outside of the playbook "$published" { "published body" { "access token" "test access token" }, $repeat (deprecated) if job is part of repeat, current iteration's key/value $loop if job is part of a loop, current iteration's key/value "$loop" { "index" 0, "key" "0", "value" "text1" }, $loop index index of the current loop iteration $loop key key of the current loop iteration $loop value value of the current loop iteration $loops if job is part of a loop or nested loop, current and nested loop iteration keys/values "$loops" { "loop aey0k" { "index" 0, "key" "0", "value" "text1" } } $loops \<loop name> specific loop name in nested loops $loops \<loop name> index index of the specific loop iteration $loops \<loop name> key key of the specific loop iteration $loops \<loop name> value value of the specific loop iteration $variables current value of any variables defined upstream of this job "$variables" { "string at7xg" "new", "number ajpro" 1, "boolean a7qe9" true, "object a4k88" { "string amul7" "" }, "array afhe7" \[ { "array agz7a" \[ "" ] } ], "attachment ah5dr" null, "iterable" \[1,2,0] } $variables \<name> value of a specific variable defined upstream $variables retrycount trigger specific notes webhook triggers use $event data for headers, query parameters, and body fields from the incoming request see docid\ sigjwtgzq4hyhogt4dzpu flow event triggers $event data matches the event data schema configured in the trigger see docid\ k dcwhmwrbngrnfblqjyn