Context Variables

context variables are variables that hold a variety of contextual information relating to the current playbook, its invocation parameters, and executed actions using context variables is especially helpful when creating playbook triggers docid 3f8fsqb1i1ykmmshyd83w to help define parameters and retrieve/store specific data this table lists some of the helpful context variables you can use context variables description example $playbook the name of the playbook find iocs $inputs user defined schema of inputs for a playbook "$inputs" { "some string playbook input" "some string passed to the playbook" } $event data related to the sensor event that triggered the playbook webhook "$event" { "data" { "headers" { "x account id" "228edce1 be3e 4b45 99d5 b4a11ac41489", "x tenant id" "911b9bae 540e 4064 93dc 33c1364587dd", "host" "turbine webhook agent pool", "connection" "close", "authorization" "basic u3dpbwxhbmu6yxnk", "user agent" "postmanruntime/7 28 3", "accept" " / ", "cache control" "no cache", "postman token" "fc42206a 66a0 4649 9885 a16e00ab8e9d", "accept encoding" "gzip, deflate, br" }, "url" { "hostname" "turbine webhook agent pool", "href" "http //turbine webhook agent pool/v1/webhook/5e60bc88 5780 42a9 8026 329fd0060d55/triggers webhook am9pa", "ips" \[], "pathname" "/v1/webhook/5e60bc88 5780 42a9 8026 329fd0060d55/triggers webhook am9pa", "port" 80, "protocol" "http", "query" {} }, "method" "get" }, "post" {}, "type" "custom webhook", "action" "request", "fqn" "turbine custom webhook request", "timestamp" 1717444327944, "sensor" { "name" "triggers webhook am9pa", "tags" {} }, "agent" { "name" "webhook agent a966253ee5a4 f975040d f3e5 4a96 beec bd729605537e", "tags" {} }, "tags" {} }, $event data related to the sensor event that triggered the playbook record "$event" { "data" { "application" { "id" "axrvgak9ufrm86lop", "uid" "records testing 658c9", "name" "records testing" }, "currentuser" { "id" "a6d44865 ed5d 4b9a a29d d0d3302d5629", "username" "swimlaneadmin\@swimlane com", "issystemuser" false }, "record" { "id" "an1kk0cot6maprd0c", "url" "https //localhost 443/account/228edce1 be3e 4b45 99d5 b4a11ac41489/tenant/911b9bae 540e 4064 93dc 33c1364587dd/record/axrvgak9ufrm86lop/an1kk0cot6maprd0c", "values" { "text" "example", "multiline text" "multi line example", "radio buttons" "option 2", "numeric" 1, "tracking id" "ort 9", "first created" "2024 06 03t19 56 10 0259161z", "last updated" "2024 06 03t19 56 10 0606078z" } } }, "post" {}, "type" "record", "action" "create", "fqn" "turbine record create", "timestamp" 1717444570268, "sensor" { "name" "turbine", "tags" {} }, "agent" { "name" "sw api", "tags" {} }, "tags" {} } $event data related to the sensor event that triggered the playbook cron "$event" { "data" { "cron" " " }, "post" {}, "type" "schedule", "action" "cron", "fqn" "turbine schedule cron", "timestamp" 1717446660290, "sensor" { "name" "turbine", "tags" {} }, "agent" { "name" "engine local", "tags" {} }, "tags" {} } $event data related to the sensor event that triggered the playbook manual "$event" { "data" {}, "post" {}, "type" "playbook", "action" "executetest", "fqn" "turbine playbook executetest", "timestamp" 1717442522695, "sensor" { "name" "turbine", "tags" {} }, "agent" { "name" "api local dev", "tags" {} }, "tags" {} $event data data/inputs from the event $event post any data post processing from the trigger $event type type of event (events, sensors, schedules) $event action action of the event type $event fqn fully qualified event name $event timestamp integer timestamp of the event in milliseconds $event sensor name name of the sensor that received the event $event sensor tags tags associated with the sensor $event agent name name of the agent that was running the sensor $event agent tags tags associated with the agent $event tags tags associated with the event $trigger name the name of the trigger cron "$trigger" { "type" "schedules", "name" "cron" } $trigger name the name of the trigger webhook "$trigger" { "type" "sensors", "name" "triggers webhook acu1r" }, $trigger name the name of the trigger records "$trigger" { "type" "records", "name" "a6tgj create" }, $trigger name the name of the trigger manual "$trigger" { "type" "events", "name" "playbook executetest" } $trigger type the type of trigger (events, sensors, schedules) $actions object containing all preceding actions that led to the current action "$actions" { "some create variables action key name" { "result" { "string at7xg" "test", "number ajpro" 1, "boolean a7qe9" true, "object a4k88" { "string amul7" "" }, "array afhe7" \[ { "array agz7a" \[ "" ] } ], "attachment ah5dr" null, "iterable" \[ 1, 2, 0 ] }, "published" {}, "status" "success" }, "some http action key name" { "result" { "status code" 200, "headers" { "date" "mon, 03 jun 2024 20 08 02 gmt", "content type" "application/json; charset=utf 8", "content length" "2110", "connection" "close", "etag" "w/\\"83e hiaiudlaghvv/6xo4efajkfvwt0\\"", "set cookie" \[ "sails sid=s%3a6nn48ik2huvfuh99u38mgwqte3kfa9zb ebtiffsxekw%2fn8r1yme8yyz2vzjxsa7posv9hbfmaqk; path=/; httponly" ] }, "status reason" "ok", "body" { "args" { "test" "1", "{\\"block 1\\" {\\"text\\" \\"some text\\",\\"text 2\\" \\"more text\\",\\"text list\\" " { "\\"text1\\",\\"text2\\",\\"text3\\"" { "1,2 2,3 45, 4" { "\\"one\\",\\"three\\"" { "\\"option 1\\",\\"option 3\\"" { "\\"ort 4\\"" { "\[\\"ort 4\\",\\"ort 5\\"],\\"reference grid\\" \[\\"ort 4\\",\\"ort 5\\"]},\\"block 2\\" \[\\"text1\\",\\"text2\\",\\"text3\\"],\\"true\\"\ true}" "\[\\"text1\\",\\"text2\\",\\"text3\\"]" } } } } } } }, "headers" { "x forwarded proto" "https", "x forwarded port" "443", "host" "postman echo com", "x amzn trace id" "root=1 665e22a1 454ed58d1b586c896b75161a", "accept encoding" "gzip, deflate, br" }, "url" "https //postman echo com/get?xxxx" } }, "published" {}, "status" "success" }, "some loop action" { "result" \[ { "script ac4ft" { "result" { "string ano7f" "text1" } } }, { "script ac4ft" { "result" { "string ano7f" "text2" } } }, { "script ac4ft" { "result" { "string ano7f" "text3" } } } ], "published" {}, "status" "success" }, "$parent" { "published" {}, "status" "fail" }, "$current" { "result" { "actions" { "createvariables atysx" { "result" { "string awuwp" "asdf" }, "published" {}, "status" "success" } }, "published" {} }, "published" {}, "status" "success" }, "newcomponent az0s4" { "result" { "actions" { "createvariables atysx" { "result" { "string awuwp" "asdf" }, "published" {}, "status" "success" } }, "published" {} }, "published" {}, "status" "success" }, "7 script" { "result" {}, "published" {}, "status" "success" }, "condition aexis" { "result" "3", "published" {}, "status" "success" }, "transformation alag3" { "result" { "block 1" { "text" "some text", "text 2" "more text", "text list" \[ "text1", "text2", "text3" ], "email" "ian schultz\@swimlane com", "url" "https //swimlane com", "rich text" "\<h3>header\</h3>", "multiline text" "multiline\ntext\ndata", "telephone" "123 345 5678", "ip" "127 0 0 1", "json" "{ \\"property1\\" \\"value 1\\", \\"property2\\" true }", "numeric" 123 4, "numeric list" \[ 1, 2 2, 3 45, 4 ], "single select" "value 2", "multi select" \[ "one", "three" ], "radio buttons" "option 2", "checkboxes" \[ "option 1", "option 3" ], "date time" "2023 11 20t10 45 03z", "date" "2023 11 20", "timespan" "123456789", "time" "10 45 03", "usergroups" "swimlaneadmin", "reference single" \[ "ort 4" ], "reference multi" \[ "ort 4", "ort 5" ], "reference grid" \[ "ort 4", "ort 5" ] }, "block 2" \[ "text1", "text2", "text3" ], "true" true }, "published" {}, "status" "success" } }, $actions \<name> result result of the specified action $actions \<name> post posted values from the specified action $actions \<name> status status of the specified action $actions $current result result of the current action (not populated until the action has run) $actions $current post posted values from the current action (not populated until the action has run) $actions $parent result result of the previous action $actions $parent post posted values from the previous action $assets object of asset names and their respective parameters "$assets" { "vt asset" { "url" "https //www virustotal com", "x apikey" "xxx", }, $published the current published object needed when mapping an output to an application record or to use outside of the playbook "$published" { "published body" { "access token" "test access token" }, $repeat (deprecated) if job is part of repeat, current iteration's key/value $loop if job is part of a loop, current iteration's key/value "$loop" { "index" 0, "key" "0", "value" "text1" }, $loop index index of the current loop iteration $loop key key of the current loop iteration $loop value value of the current loop iteration $loops if job is part of a loop or nested loop, current and nested loop iteration keys/values "$loops" { "loop aey0k" { "index" 0, "key" "0", "value" "text1" } } $loops \<loop name> specific loop name in nested loops $loops \<loop name> index index of the specific loop iteration $loops \<loop name> key key of the specific loop iteration $loops \<loop name> value value of the specific loop iteration $variables current value of any variables defined upstream of this job "$variables" { "string at7xg" "new", "number ajpro" 1, "boolean a7qe9" true, "object a4k88" { "string amul7" "" }, "array afhe7" \[ { "array agz7a" \[ "" ] } ], "attachment ah5dr" null, "iterable" \[1,2,0] } $variables \<name> value of a specific variable defined upstream for a list of top level properties that are defined on the $event data object when configuring webhook triggers, see event data properties in the webhook triggers section