Security Center:System components

Default output gateway

Connect a node directly to its downstream branch nodes using connection lines. Conditional configuration is not supported.

Single output (exclusive gateway)

Runs only the first branch whose condition is met. Use this when branches are mutually exclusive — for example, routing by alert severity level.

1. Drag the Single Output component from the basic nodes area onto the canvas.

2. Click the Single Output component. On the basic information tab, click Configure to open the condition configuration page.

   • Click ADD IF or AND ELSE IF to add condition groups. Each condition group maps to one branch.

   • Rename condition groups to make them easier to distinguish.

   • Click OK to save.

3. Connect each branch:

   1. Hover over the single output gateway icon and click a connection point to draw a line to a branch node.

   2. Click the connection line and select the condition configured in step 2 from the drop-down list.

Multiple output

Runs all branches whose conditions are met. Unlike the single output gateway, this does not stop at the first match.

1. Drag the Multiple Output component from the basic nodes area onto the canvas.

2. Click the Multiple Output component. On the basic information tab, click Configure to open the condition configuration page.

   • Click ADD IF to add condition groups. Each condition group can map to multiple branches.

   • Rename condition groups to make them easier to distinguish.

   • Click OK to save.

3. Connect each branch:

   1. Hover over the multiple output gateway icon and click a connection point to draw a line to a branch node.

   2. Click the connection line and select the condition configured in step 2 from the drop-down list.

The same condition can be assigned to different connection lines.

Default input gateway

Connect nodes directly to downstream branch nodes using connection lines.

Converging gateway

Use this when downstream execution must only proceed if specific upstream branches have been executed.

1. Drag the Converging component from the basic nodes area onto the canvas.

2. Connect each upstream node to the Parallel Gateway component using a connection line.

   

3. Click each connection line and select Required or Non-required from the drop-down list.

If a connection line is set to Required, the node on that path must complete execution. If it does not, downstream nodes are not triggered.

Configure a loop on a child flow

1. Click Enable Loop.

2. Set Loop Mode:

   • Do-while: The loop body runs first, then the exit condition is checked.

   • While-do: The exit condition is checked first, then the loop body runs.

3. Set Maximum Loops to prevent infinite loops.

4. Set the Loop Exit Condition. Any output parameter from nodes inside the child flow can be used as a condition value. For configuration details, see Component condition configuration.

Loop end logic: A loop iteration ends only after all nodes triggered in that iteration have finished — including nodes still running when other nodes have already reached the end node. The next iteration does not start until the current iteration is fully complete.

Built-in loop variables:

For example, use ${child_flow_name.curIndex} in the NotifyMessage component to index into an array passed from the parent flow's start node.

Condition configuration example

The condition above is met when name equals "john" or "alice" and age is between 12 and 20 (inclusive).

Condition judgment rules

Dataset rules

Before using Dataset rules, configure observation lists in Security Center > Agentic SOC > Integration Center > Observation Lists.

String rules

Number rules