---
title: Nesting, Branching, and Conditions Loops Use Case
slug: nesting-branching-and-conditions-loops-use-case
docTags: 
createdAt: 2025-08-11T11:13:49.000Z
---

Loops are a great way to iterate data inside a playbook without having to nest another playbook. Let's take a look at a use case.

## Scenario

Mei is an orchestrator who wants to get a count of IP addresses that are considered malicious. She wants to get the list of IP addresses from specific regions, iterate the data, get a threat score for each IP address, then create conditions that filter out benign IP addresses but return a verdict of malicious IP addresses, then have an action that provide that list. Let's watch as she creates her playbook.

Mei starts by creating a playbook with a webhook trigger.

1. Configure your webhook with the desired data.
2. Mei created a webhook trigger that sends data for a list of regions and the list of IP addresses within those regions.

::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/XcwX4BvVhyM2Fpgun2IdC_nesting-branching-conditions-use-case1.png" size="66" width="1166" height="668" darkWidth="800" darkHeight="458" position="center" indent="2" showCaption="false"}

3. Now she wants to iterate over nested lists in a single object without having to use nested playbooks. To do this, she adds a loop.
4. Click **Add an action** and select **Loop**. Mei names her action **loop over regions**, ensures the Process of the loop is **Sequential**, and is ready to configure.
5. Next, under **Configuration**, click **Select a property or expression**.
6. To get the region data, from the playbook properties, click **regions**.

::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/0VKzRU0Pcsdnv3bXYGqIq_nesting-branching-conditions-use-case2.png" size="54" width="626" height="691" darkWidth="800" darkHeight="883" position="center" indent="2" showCaption="false"}

Now Mei has her first loop and is ready to add her first nested loop.

1. Click **Add an action** and select **Loop**. Mei names her action **Loop Over IPs**, ensures the Process of the loop is **Sequential**, and is ready to configure.
2. Next, under **Configuration**, click **Select a property or expression**. This time, she will select a different playbook property.
3. To get the IP values, from the playbook properties, click the Loop Over Regions actions, then selects **Value**. The next step is to retrieve IP scores for those regions. Mei adds a **Script** native action called **Get IP Score**. From the Script tab, under Inputs, she completes the following steps:
4. Click **Add property**, selects **String**, and clicks **Select a property**. Mei names the text field **IP**. When the playbook property drawer opens, she selects the same property as step 7: Loop Over Regions action, then select **Value**.
5. From the Script tab, under Script, enter the following code: `action_outputs = random.randint(1, 100) `
6. If Mei wants to test this before continuing to build her playbook, she can click the Test tab, enter the same values and click the **Test** button. For more information on testing scripts, Mei reviews [Discovered Outputs and Testing](docId:0m_vna2tE15I4msHcDnJ1). It's time to filter those IP scores using the **Condition** native action. Mei wants to filter any IP scores higher than 50 to be marked as malicious. Anything below 50 should be marked as benign.
7. Add an on success **Condition** native action.
8. Click **CREATE YOUR FIRST CONDITION** and from the playbook properties, select the Script action's **result**.
9. Set the operator to **IS GREATER THAN** and the value to **50**.

::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/6usdfqcvD3KbDSM0JIbQv_nesting-branching-conditions-use-case3.png" size="64" width="1143" height="642" position="center" indent="2" showCaption="false"}

Mei saves her changes and now her IF/ELSE condition is configured and she's ready to add the last two actions within her nested loop.

1. From the TRUE condition, click **Add an action** and select **Script**. Mei titles the action **Mark as Malicious** so that it's easy to identify if the IP score is over 50.
2. Click **Add property**, selects **Number**, and clicks **Select a property**. Mei names the text field **score**. When the playbook property drawer opens, she selects the Get IP Score result.
3. From the Script tab, under Script, enter the following code:
   `action_outputs = {"verdict": "Malicious", "score": action_inputs["score"]}`
4. This generates the output with the verdict malicious. For the last action inside the loop, Mei needs to add another Script action to output a score below 50 with a verdict of benign.
5. From the FALSE condition, click **Add an action** and select **Script**. Mei titles the action **Mark as Benign** so that it's easy to identify if the IP score is below 50.
6. Click **Add property**, selects **Number**, and clicks **Select a property**. Mei names the text field **score**. When the playbook property drawer opens, she selects the Get IP Score result.
7. From the Script tab, under Script, enter the following code:
   `action_outputs = {"verdict": "Benign", "score": action_inputs["score"]}`
8. This generates the output with the verdict benign. It's time for the last action that runs after the outer loop. Mei adds one final Script native action, names it **Count Malicious**, and is ready to configure. The action counts the number of malicious IP addresses by iterating over the results.
9. From the Script tab, under Inputs, click **Add property**, selects **Object**, and clicks **Select a property**.
10. From the playbook property drawer, click the Loop Over Regions action and select result.
11. From the Script tab, under Scripts, enter the following code:
    `scores = [] for entry in action_inputs["prev"]: for result in entry["loop_over_Ips"]["result"]: if 'mark_as_malicious' in result.keys(): scores.append(result["mark_as_malicious"]["result"]["score"]) action_outputs = len(scores)`

## Conclusion

Mei successfully used Turbine nested loops, conditions, and other native actions to get a count of IP addresses that are considered malicious.