Security Center:Component parameters and node execution flow

Playbook-level system parameters

Use ${event.parameter_name} to access these parameters from any node. event is the reserved name of the start node; do not name any component event during playbook orchestration.

Component action output parameters

Every node execution produces the following standard output fields. Custom output parameters from the component are stored inside datalist. Use ${node_name.datalist.*} to retrieve all output values.

Built-in functions

All expressions use Java syntax. Functions are grouped by category below.

Reference syntax

The examples below all use the following node1 output as the data source:

{
  "datalist": [
    { "person": { "weight": "120", "age": "12" } },
    { "person": { "weight": "121", "age": "13" } }
  ],
  "total_data_successful": 2,
  "total_data": 2,
  "total_exe_successful": 2,
  "total_exe": 2,
  "total_data_with_dup": 2,
  "status": true
}

For datalist-based paths, * means all items; [0] means the first item. The start node uses event instead of a node name: ${event.parameter1.parameter2}.

Tip: Instead of writing variable syntax manually, use the parameter drop-down selector in the input box to generate the correct path after you finish testing.

Examples

The following examples use the same node1 output defined in the Reference syntax section.

Input (single JSONObject): {"src_ip":"127.0.0.1","dst_ip":"127.0.0.2","msg":"hello"}

Input (JSONArray in datalist): {"datalist":[{"src_ip":"127.0.0.1","dst_ip":"127.1.0.1","msg":"hello"},{"src_ip":"127.1.0.1","dst_ip":"127.1.0.1","msg":"hello"}]}

Stage 1: Extract input parameters

The system resolves the node's input configuration against the actual outputs of upstream nodes and the playbook's input parameters to produce one or more sets of concrete input values.

Stage 2: Deduplicate and execute

If the resolved input produces multiple identical parameter sets, the system deduplicates them before execution. The action then runs once for each unique parameter set.

When an input expression resolves to multiple values (for example, ${node1.datalist.*.ip} matching five IP addresses), the action runs once per value automatically. No loop logic is needed in the playbook. Example: To run "Purge Malicious File" on all servers of a compromised application, set the Server IP parameter to ${node1.datalist.*.ip}. The system executes the action on each IP address without any additional configuration.

Stage 3: Aggregate and deduplicate output

Results from all action executions are merged into a single output. The system deduplicates entries where every field is identical.

Example:

Parameter extraction rules

Multiple data sources

When a node references parameters from multiple upstream nodes, the system applies a Cartesian product across the extraction results of each source.