Security Center:SOAR component parameters and execution

Parameter

Data type

Expression

Description

_tenant_id

String

${event._tenant_id}

The Alibaba Cloud account ID that calls the playbook.

_domain_id

String

${event._domain_id}

The role status of the logged-on user.

• 0: Indicates single account logon.

• 1: Indicates global account logon.

_trigger_user

String

${event._trigger_user}

The Alibaba Cloud account ID that triggers the playbook. If a RAM user is used, the RAM user ID is returned.

_region_id

String

${event._region_id}

The region ID.

_req_uuid

String

${event._req_uuid}

The unique identifier of the current playbook execution task.

parentTaskUuid

String

${event.parentTaskUuid}

The _req_uuid of the parent playbook. This parameter exists when a child playbook is called.

parentTaskName

String

${event.parentTaskName}

The UUID of the parent playbook. This parameter exists when a child playbook is called.

Parameter

Data type

Description

datalist

JSONArray

The output parameters after the component is executed.

total_data_successful

Int

The amount of data successfully processed during component execution.

total_data

Int

The amount of data processed during execution.

total_data_with_dup

Int

The amount of data successfully processed after deduplication during execution.

total_exe_successful

Int

The number of times the current component has been successfully executed.

total_exe

Int

The number of times the current component has been executed.

status

Boolean

The success status of the execution. Valid values: true and false.

messageForUser

String

The error message that users need to focus on when execution fails.

message

String

Error message returned by the system when the execution failed.

failed_exe_detail

String

The detailed error information when execution fails.

Function

Description

Example

Example output

currentTime

Returns the current timestamp.

<%=currentTime()%>

2025-06-05 10:30:00

secondstamp_add

Adds seconds to the current timestamp.

<%=secondstamp_add(currentTime(),300L)%>

2025-06-05 10:30:09

formatTimeStamp

Formats the input timestamp according to the specified format.

<%=formatTimeStamp(currentTime(),"yyyyMMdd")%>

20250605

timestampToseconds

Adds seconds to the current timestamp and converts it to seconds for output.

<%=timestampToseconds(currentTime(),300L)%>

1749099848

splitStr

Splits the input string into a list based on splitStr.

<%=splitStr("test,value",",")%>

[test, value]

parseTimeMs

Converts a time format string to milliseconds.

<%=parseTimeMs("2025-06-05 10:30:32","yyyy-MM-ddHH:mm:ss")%>

1749090632000

currentTimeToMs

Converts the current timestamp to milliseconds.

<%=currentTimeToMs()%>

1749091369688

currentHourToMs

Converts the current hour's timestamp to milliseconds, calculated from 0 minutes and 0 seconds of the current hour.

<%=currentHourToMs()%>

1749088800000

currentDayToMs

Converts the current day's timestamp to milliseconds, calculated from 0 hours, 0 minutes, and 0 seconds of the current day.

<%=currentDayToMs()%>

1749052800000

parseTimeMsWDefault

Parses a timestamp into milliseconds with default value supported. If parameter 1 is empty, parameter 2 is used as the default value.

<%=parseTimeMsWDefault("2025-06-05 10:30:32",1749091369688L)%>

1749090632000

splitStrToJsonArray

Splits the input string into a JSONArray based on splitStr.

<%=splitStrToJsonArray("test,value",",")%>

["test","value"]

concatListStr

Concatenates strings using a connector. Must be used with the splitStr function.

<%=concatListStr("|",splitStr("test,value",","))%>

test|value

substring

Extracts a substring.

Parameter 1: The string to extract from.

Parameter 2: The starting index.

Parameter 3: The ending index.

<%=substring("012345",0,3)%>

012

remainStrStartEnd

Preserves characters outside the start and end indices. Specifically, it keeps beginSize characters from the beginning of inputStr and endSize characters from the end, connecting them with five underscores.

• Parameter 1: The string to extract from.

• Parameter 2: The starting index.

• Parameter 3: The ending index.

<%=remainStrStartEnd("012345",2,2)%>

01_____45

toLong

Converts an object to long type.

Parameter 1: The input value.

Parameter 2: The default value if conversion fails.

<%=toLong("1234",12L)%>

1234.0

toLowerCase

Converts English letters in a string to lowercase.

<%=toLowerCase("TEST")%>

test

toUpperCase

Converts English letters in a string to uppercase.

<%=toUpperCase("test")%>

TEST

toJSONObject

Converts a JSON string to a JSON object.

<%=toJSONObject("{\"name\":\"test\",\"age\":12}")%>

{"name":"test","age":12}

base64encode

Performs Base64 encoding on a string.

<%=base64encode("abc")%>

YWJj

base64decode

Performs Base64 decoding on a string.

<%=base64decode("YWJj")%>

abc

replace

Replaces strings.

• Parameter 1: The string to modify.

• Parameter 2: The string to replace.

• Parameter 3: The new string.

<%=replace("abc123","abc","aaa")%>

aaa123

isNull

Determines whether an object is empty.

<%=isNull("")%>

true