Ringkasan komponen DataFormat untuk playbook SOAR - Security Center

Komponen DataFormat menyediakan kemampuan pemrosesan data, seperti menggabungkan dan mengonkatenasi data terkait.

Fitur

Action	Description	Scenarios
joindata	Menggabungkan beberapa tabel dan menghasilkan bidang yang ditentukan.	Menggabungkan dua atau lebih tabel berdasarkan kunci.
groupbydata	Mengelompokkan data masukan berdasarkan kunci.	Mengelompokkan array.
concatFiledtoBatch	Mengonkatenasi nilai data masukan dalam batch. Anda dapat menambahkan awalan, akhiran, dan string pemisah.	Mengonkatenasi konten dalam array.
leftJoin	Menjalankan left join dengan node kiri sebagai tabel utama dan menghasilkan bidang yang ditentukan.	Menyimpan semua data dari node kiri selama penggabungan dan membuang data yang tidak relevan dari node kanan.
convertToJson	Mengonversi string menjadi objek JSON.	Mengonversi string menjadi objek JSON.
uniondata	Menggabungkan beberapa baris data. Aksi ini menggabungkan beberapa objek JSONObject untuk membentuk JSONArray baru.	Menggabungkan beberapa objek JSON menjadi satu JSONArray.
formatdata	Transformasi data dan membuat tabel baru.	Transformasi data atau mengagregasi data dari beberapa sumber ke dalam satu tabel.

Contoh konfigurasi komponen

Topik ini menyediakan contoh konfigurasi untuk setiap aksi komponen DataFormat. Anda dapat mengimpor contoh-contoh ini sebagai playbook uji untuk menggunakan editor orkestrasi visual. Editor ini membantu Anda memahami dan menguji parameter konfigurasi untuk setiap aksi, sehingga mempermudah pembelajaran fitur-fitur komponen. Untuk informasi lebih lanjut, lihat Impor playbook.

Catatan

Simpan data sampel sebagai file JSON sebelum memulai.

{
  "cells": [
    {
      "position": {
        "x": -510,
        "y": 20
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "label": {
          "text": "",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        },
        "path": {
          "stroke": "#63ba4d"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "StartEvent_1",
      "zIndex": 1,
      "data": {
        "nodeType": "startEvent",
        "appType": "basic",
        "valueData": {

        },
        "icon": "icon-circle"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "position": {
        "x": -110,
        "y": 5
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "8d42d64a-fb1a-41fe-aeeb-000849b57892",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "leftJoin",
        "valueData": {
          "leftNode": "[{\"action\":\"11\",\"uuid\":[{\"uuid-key\":\"1\"}]},{\"action\":\"21\",\"uuid\":[{\"uuid-key\":\"2\"}]}]",
          "rightNode": "[{\"uuid\":[{\"uuid-key\":\"1\"}],\"host\":\"196.1.*.*\"},{\"uuid\":[{\"uuid-key\":\"1\"}],\"host\":\"196.2.*.*\"}]",
          "joinFields": "[{\"fieldName\":\"leftNode.uuid\",\"fieldValue\":\"rightNode.uuid\"}]",
          "leftOutputFilelds": "[{\"fieldName\":\"*\",\"fieldValue\":\"action,uuid\"}]",
          "rightOutputFields": "[{\"fieldName\":\"site\",\"fieldValue\":\"host\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Left Join. Returns all rows from the left table (table_name1), even if there are no matching rows in the right table (table_name2).",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "leftJoin",
        "cascaderValue": [],
        "status": "success"
      },
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "17bbdf75-e724-4c63-a055-e184bf946b87",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "StartEvent_1"
      },
      "target": {
        "cell": "8d42d64a-fb1a-41fe-aeeb-000849b57892"
      }
    },
    {
      "position": {
        "x": 222.5,
        "y": 10
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "path": {
          "r": 12,
          "refX": "50%",
          "refY": "50%",
          "fill": "#63ba4d",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 4
        },
        "label": {
          "text": "End",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "957ea6d3-2562-4f0f-829e-f3613f9e1f16",
      "zIndex": 1,
      "data": {
        "nodeType": "endEvent",
        "appType": "basic",
        "nodeName": "End",
        "icon": "icon-radio-off-full",
        "description": "Playbook end node"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "circle",
          "selector": "path"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "ada87a01-f8ff-4222-b33d-c42e3367ff47",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "8d42d64a-fb1a-41fe-aeeb-000849b57892"
      },
      "target": {
        "cell": "957ea6d3-2562-4f0f-829e-f3613f9e1f16"
      },
      "vertices": []
    },
    {
      "position": {
        "x": -310,
        "y": 110
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "7309e77a-0c93-4396-b28b-9b0c1672cd4e",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "leftJSON",
        "valueData": {
          "inputData": "[{\"action\":\"11\",\"uuid\":[{\"uuid-key\":\"1\"}]},{\"action\":\"21\",\"uuid\":[{\"uuid-key\":\"2\"}]}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Converts the input data to the JSON type. If the input is a JSONArray, all its elements are placed directly into the datalist. If the input is a JSONObject, it is treated as a single row in the datalist.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "convertToJSON",
        "status": "success"
      },
      "isNode": true
    },
    {
      "position": {
        "x": -68,
        "y": 110
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "e3134166-6d6c-4879-846b-a9b00ad6c4a6",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "rightJSON",
        "valueData": {
          "inputData": "[{\"uuid\":[{\"uuid-key\":\"1\"}],\"host\":\"196.1.*.*\"},{\"uuid\":[{\"uuid-key\":\"1\"}],\"host\":\"196.2.*.*\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Converts the input data to the JSON type. If the input is a JSONArray, all its elements are placed directly into the datalist. If the input is a JSONObject, it is treated as a single row in the datalist.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "convertToJSON",
        "cascaderValue": [
          {
            "label": "leftJSON",
            "value": "${leftJSON}",
            "children": [
              {
                "label": "leftJSON.total_data",
                "name": "leftJSON.total_data",
                "value": "${leftJSON.total_data}"
              },
              {
                "label": "leftJSON.status",
                "name": "leftJSON.status",
                "value": "${leftJSON.status}"
              },
              {
                "label": "leftJSON.total_exe",
                "name": "leftJSON.total_exe",
                "value": "${leftJSON.total_exe}"
              },
              {
                "label": "leftJSON.datalist.*.uuid.*.uuid-key",
                "name": "leftJSON.datalist.*.uuid.*.uuid-key",
                "value": "${leftJSON.datalist.*.uuid.*.uuid-key}"
              },
              {
                "label": "leftJSON.total_data_successful",
                "name": "leftJSON.total_data_successful",
                "value": "${leftJSON.total_data_successful}"
              },
              {
                "label": "leftJSON.total_data_with_dup",
                "name": "leftJSON.total_data_with_dup",
                "value": "${leftJSON.total_data_with_dup}"
              },
              {
                "label": "leftJSON.total_exe_successful",
                "name": "leftJSON.total_exe_successful",
                "value": "${leftJSON.total_exe_successful}"
              },
              {
                "label": "leftJSON.datalist.*.action",
                "name": "leftJSON.datalist.*.action",
                "value": "${leftJSON.datalist.*.action}"
              }
            ]
          }
        ],
        "status": "success"
      },
      "isNode": true
    },
    {
      "position": {
        "x": 172,
        "y": 110
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "0ac43fe1-2031-4b6e-a883-d788c603e944",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "joindata",
        "valueData": {
          "inputNodes": "[{\"fieldName\":\"leftJSON\",\"fieldValue\":\"${JSONArray:leftJSON.datalist.*}\"},{\"fieldName\":\"rightJSON\",\"fieldValue\":\"${JSONArray:rightJSON.datalist.*}\"}]",
          "joinFields": "[{\"fieldName\":\"leftJSON.uuid\",\"fieldValue\":\"rightJSON.uuid\"}]",
          "outputFields": "[{\"fieldName\":\"myhost\",\"fieldValue\":\"rightJSON.host\"},{\"fieldName\":\"myaction\",\"fieldValue\":\"leftJSON.action\"},{\"fieldName\":\"uuid\",\"fieldValue\":\"leftJSON.uuid\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Provides a syntax similar to a multi-table JOIN. It treats the datalist.* data from the processing nodes as a table with multiple rows and columns.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "joindata",
        "cascaderValue": [
          {
            "label": "rightJSON",
            "value": "${rightJSON}",
            "children": [
              {
                "label": "rightJSON.total_data_with_dup",
                "name": "rightJSON.total_data_with_dup",
                "value": "${rightJSON.total_data_with_dup}"
              },
              {
                "label": "rightJSON.total_data",
                "name": "rightJSON.total_data",
                "value": "${rightJSON.total_data}"
              },
              {
                "label": "rightJSON.status",
                "name": "rightJSON.status",
                "value": "${rightJSON.status}"
              },
              {
                "label": "rightJSON.datalist.*.host",
                "name": "rightJSON.datalist.*.host",
                "value": "${rightJSON.datalist.*.host}"
              },
              {
                "label": "rightJSON.total_exe_successful",
                "name": "rightJSON.total_exe_successful",
                "value": "${rightJSON.total_exe_successful}"
              },
              {
                "label": "rightJSON.datalist.*.uuid.*.uuid-key",
                "name": "rightJSON.datalist.*.uuid.*.uuid-key",
                "value": "${rightJSON.datalist.*.uuid.*.uuid-key}"
              },
              {
                "label": "rightJSON.total_data_successful",
                "name": "rightJSON.total_data_successful",
                "value": "${rightJSON.total_data_successful}"
              },
              {
                "label": "rightJSON.total_exe",
                "name": "rightJSON.total_exe",
                "value": "${rightJSON.total_exe}"
              }
            ]
          },
          {
            "label": "leftJSON",
            "value": "${leftJSON}",
            "children": [
              {
                "label": "leftJSON.total_data",
                "name": "leftJSON.total_data",
                "value": "${leftJSON.total_data}"
              },
              {
                "label": "leftJSON.status",
                "name": "leftJSON.status",
                "value": "${leftJSON.status}"
              },
              {
                "label": "leftJSON.total_exe",
                "name": "leftJSON.total_exe",
                "value": "${leftJSON.total_exe}"
              },
              {
                "label": "leftJSON.datalist.*.uuid.*.uuid-key",
                "name": "leftJSON.datalist.*.uuid.*.uuid-key",
                "value": "${leftJSON.datalist.*.uuid.*.uuid-key}"
              },
              {
                "label": "leftJSON.total_data_successful",
                "name": "leftJSON.total_data_successful",
                "value": "${leftJSON.total_data_successful}"
              },
              {
                "label": "leftJSON.total_data_with_dup",
                "name": "leftJSON.total_data_with_dup",
                "value": "${leftJSON.total_data_with_dup}"
              },
              {
                "label": "leftJSON.total_exe_successful",
                "name": "leftJSON.total_exe_successful",
                "value": "${leftJSON.total_exe_successful}"
              },
              {
                "label": "leftJSON.datalist.*.action",
                "name": "leftJSON.datalist.*.action",
                "value": "${leftJSON.datalist.*.action}"
              }
            ]
          }
        ],
        "status": "success"
      },
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "a6f70a6a-f5a0-4e5c-9de5-5230dc1deefa",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "router": {
        "name": "normal"
      },
      "isNode": false,
      "source": {
        "cell": "StartEvent_1"
      },
      "target": {
        "cell": "7309e77a-0c93-4396-b28b-9b0c1672cd4e"
      },
      "vertices": [
        {
          "x": -492,
          "y": 143
        }
      ]
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "13db0fe6-495d-4b16-80ca-df96d33beff1",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "7309e77a-0c93-4396-b28b-9b0c1672cd4e"
      },
      "target": {
        "cell": "e3134166-6d6c-4879-846b-a9b00ad6c4a6"
      }
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "9f472b01-bb53-4bac-a8dd-a67c3c537fa9",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "e3134166-6d6c-4879-846b-a9b00ad6c4a6"
      },
      "target": {
        "cell": "0ac43fe1-2031-4b6e-a883-d788c603e944"
      }
    },
    {
      "position": {
        "x": 440,
        "y": 110
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "path": {
          "r": 12,
          "refX": "50%",
          "refY": "50%",
          "fill": "#63ba4d",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 4
        },
        "label": {
          "text": "End",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "a66c2f32-7d29-40a2-8e7e-622f09cf23dd",
      "zIndex": 1,
      "data": {
        "nodeType": "endEvent",
        "appType": "basic",
        "nodeName": "End",
        "icon": "icon-radio-off-full",
        "description": "Playbook end node"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "circle",
          "selector": "path"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "caf56653-94c8-42f8-beec-f4deb72dc93f",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "0ac43fe1-2031-4b6e-a883-d788c603e944"
      },
      "target": {
        "cell": "a66c2f32-7d29-40a2-8e7e-622f09cf23dd"
      }
    },
    {
      "position": {
        "x": -310,
        "y": 262
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "83110da4-c8e7-4d19-8e79-51f8903625b2",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "mockData",
        "valueData": {
          "inputData": "[{\"Attack Type\":\"web shell\",\"count\":\"1\",\"startTime\":\"1646115503000\",\"endTime\":\"1646115503000\",\"securityEventIds\":\"330706\"},{\"Attack Type\":\"web shell\",\"count\":\"1\",\"startTime\":\"1646114346000\",\"endTime\":\"1646114346000\",\"securityEventIds\":\"330700\"},{\"Attack Type\":\"application whitelist\",\"count\":\"1\",\"startTime\":\"1646114098000\",\"endTime\":\"1646114098000\",\"securityEventIds\":\"330699\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Converts the input data to the JSON type. If the input is a JSONArray, all its elements are placed directly into the datalist. If the input is a JSONObject, it is treated as a single row in the datalist.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "convertToJSON",
        "status": "success"
      },
      "isNode": true
    },
    {
      "position": {
        "x": -80,
        "y": 262
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "5314c487-af24-4dbf-bc11-f79bed39b60b",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "groupbydata",
        "valueData": {
          "inputNode": "${JSONArray:mockData.datalist.*}",
          "groupByKeys": "Attack Type",
          "outputFields": "[{\"fieldName\":\"Attack Count\",\"fieldType\":\"jq\",\"fieldValue\":\".datalist | map_values(.count)|add|length\"},{\"fieldName\":\"Latest Attack Time\",\"fieldType\":\"jq\",\"fieldValue\":\"[.datalist[].endTime|tonumber]|max\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Performs an aggregate operation on a data source.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "groupbydata",
        "status": "success"
      },
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "e0ac28e4-a693-4c24-aad6-e56349468ecc",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "router": {
        "name": "normal"
      },
      "isNode": false,
      "source": {
        "cell": "StartEvent_1"
      },
      "target": {
        "cell": "83110da4-c8e7-4d19-8e79-51f8903625b2"
      },
      "vertices": [
        {
          "x": -492,
          "y": 295
        }
      ]
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "a555fddb-9eb9-48f8-8d01-836537104767",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "83110da4-c8e7-4d19-8e79-51f8903625b2"
      },
      "target": {
        "cell": "5314c487-af24-4dbf-bc11-f79bed39b60b"
      }
    },
    {
      "position": {
        "x": 240,
        "y": 270
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "path": {
          "r": 12,
          "refX": "50%",
          "refY": "50%",
          "fill": "#63ba4d",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 4
        },
        "label": {
          "text": "End",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "7779ea7e-b587-4512-94e0-d00dc76251e4",
      "zIndex": 1,
      "data": {
        "nodeType": "endEvent",
        "appType": "basic",
        "nodeName": "End",
        "icon": "icon-radio-off-full",
        "description": "Playbook end node"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "circle",
          "selector": "path"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "70f8f4cc-0561-4bd8-aecd-6fa2441c0b38",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "5314c487-af24-4dbf-bc11-f79bed39b60b"
      },
      "target": {
        "cell": "7779ea7e-b587-4512-94e0-d00dc76251e4"
      }
    },
    {
      "position": {
        "x": -140,
        "y": 400
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "a6080934-1dd4-4d87-b573-1f90be7d4535",
      "zIndex": 1,
      "data": {
        "isDebug": false,
        "nodeType": "action",
        "appType": "component",
        "nodeName": "concatFieldtoBatch",
        "valueData": {
          "inputField": "[{\"Attack Type\":\"web shell\"},{\"Attack Type\":\"web shell\"},{\"Attack Type\":\"web shell\"},{\"Attack Type\":\"application whitelist\"},{\"Attack Type\":\"application whitelist\"}]",
          "batchSize": "2",
          "concatStr": "\" ## \"",
          "fieldAddPrefix": "Prefix",
          "fieldAddSuffix": "Suffix"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Splits the values of a field into mini-batches and concatenates each batch into a string.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "concatFieldtoBatch",
        "status": "success",
        "cascaderValue": []
      },
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "06606aa2-6573-4fe2-83e3-2f66bb70db76",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "router": {
        "name": "normal"
      },
      "isNode": false,
      "source": {
        "cell": "StartEvent_1"
      },
      "target": {
        "cell": "a6080934-1dd4-4d87-b573-1f90be7d4535"
      },
      "vertices": [
        {
          "x": -492,
          "y": 433
        }
      ]
    },
    {
      "position": {
        "x": 198,
        "y": 415
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "path": {
          "r": 12,
          "refX": "50%",
          "refY": "50%",
          "fill": "#63ba4d",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 4
        },
        "label": {
          "text": "End",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "59bc46fa-d6cb-4e89-9107-d30216c01d2b",
      "zIndex": 1,
      "data": {
        "nodeType": "endEvent",
        "appType": "basic",
        "nodeName": "End",
        "icon": "icon-radio-off-full",
        "description": "Playbook end node"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "circle",
          "selector": "path"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "fc410d6d-ff0f-4d01-8c0b-2a2e3104d8ce",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "a6080934-1dd4-4d87-b573-1f90be7d4535"
      },
      "target": {
        "cell": "59bc46fa-d6cb-4e89-9107-d30216c01d2b"
      }
    },
    {
      "position": {
        "x": -180,
        "y": -180
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "c1fd4832-8717-44d8-9a27-dc6f45499f47",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "convertToJSON",
        "valueData": {
          "inputData": "[{\"Attack Type\":\"web shell\"},{\"Attack Type\":\"web shell\"},{\"Attack Type\":\"web shell\"},{\"Attack Type\":\"application whitelist\"},{\"Attack Type\":\"application whitelist\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Converts the input data to the JSON type. If the input is a JSONArray, all its elements are placed directly into the datalist. If the input is a JSONObject, it is treated as a single row in the datalist.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "convertToJSON",
        "status": "success"
      },
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "4f498976-09d4-4550-9e73-2241077b1922",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "router": {
        "name": "normal"
      },
      "isNode": false,
      "source": {
        "cell": "StartEvent_1"
      },
      "target": {
        "cell": "c1fd4832-8717-44d8-9a27-dc6f45499f47"
      },
      "vertices": [
        {
          "x": -492,
          "y": -147
        }
      ]
    },
    {
      "position": {
        "x": 121,
        "y": -165
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "path": {
          "r": 12,
          "refX": "50%",
          "refY": "50%",
          "fill": "#63ba4d",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 4
        },
        "label": {
          "text": "End",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "46a3b954-56d1-4fd2-b016-08e144390137",
      "zIndex": 1,
      "data": {
        "nodeType": "endEvent",
        "appType": "basic",
        "nodeName": "End",
        "icon": "icon-radio-off-full",
        "description": "Playbook end node"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "circle",
          "selector": "path"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "96eddfbb-e835-43e0-8d7a-df75888519fb",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "c1fd4832-8717-44d8-9a27-dc6f45499f47"
      },
      "target": {
        "cell": "46a3b954-56d1-4fd2-b016-08e144390137"
      }
    },
    {
      "position": {
        "x": 117.5,
        "y": 505
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "ec535172-836f-4e5e-9e4a-ef546f030f5d",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "uniondata",
        "valueData": {
          "inputNodes": "[{\"fieldName\":\"leftJSON\",\"fieldValue\":\"${JSONArray:left.datalist.*}\"},{\"fieldName\":\"rightJSON\",\"fieldValue\":\"${JSONArray:right.datalist.*}\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Unions the multi-row results from multiple upstream nodes.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "uniondata",
        "cascaderValue": [
          {
            "label": "right",
            "value": "${right}",
            "children": [
              {
                "label": "right.total_data_with_dup",
                "name": "right.total_data_with_dup",
                "value": "${right.total_data_with_dup}"
              },
              {
                "label": "right.total_data_successful",
                "name": "right.total_data_successful",
                "value": "${right.total_data_successful}"
              },
              {
                "label": "right.status",
                "name": "right.status",
                "value": "${right.status}"
              },
              {
                "label": "right.total_data",
                "name": "right.total_data",
                "value": "${right.total_data}"
              },
              {
                "label": "right.datalist.*.uuid.*.uuid-key",
                "name": "right.datalist.*.uuid.*.uuid-key",
                "value": "${right.datalist.*.uuid.*.uuid-key}"
              },
              {
                "label": "right.total_exe",
                "name": "right.total_exe",
                "value": "${right.total_exe}"
              },
              {
                "label": "right.total_exe_successful",
                "name": "right.total_exe_successful",
                "value": "${right.total_exe_successful}"
              },
              {
                "label": "right.datalist.*.host",
                "name": "right.datalist.*.host",
                "value": "${right.datalist.*.host}"
              }
            ]
          },
          {
            "label": "left",
            "value": "${left}",
            "children": [
              {
                "label": "left.total_data",
                "name": "left.total_data",
                "value": "${left.total_data}"
              },
              {
                "label": "left.total_exe_successful",
                "name": "left.total_exe_successful",
                "value": "${left.total_exe_successful}"
              },
              {
                "label": "left.status",
                "name": "left.status",
                "value": "${left.status}"
              },
              {
                "label": "left.datalist.*.action",
                "name": "left.datalist.*.action",
                "value": "${left.datalist.*.action}"
              },
              {
                "label": "left.datalist.*.uuid.*.uuid-key",
                "name": "left.datalist.*.uuid.*.uuid-key",
                "value": "${left.datalist.*.uuid.*.uuid-key}"
              },
              {
                "label": "left.total_exe",
                "name": "left.total_exe",
                "value": "${left.total_exe}"
              },
              {
                "label": "left.total_data_with_dup",
                "name": "left.total_data_with_dup",
                "value": "${left.total_data_with_dup}"
              },
              {
                "label": "left.total_data_successful",
                "name": "left.total_data_successful",
                "value": "${left.total_data_successful}"
              }
            ]
          }
        ],
        "status": "success"
      },
      "isNode": true
    },
    {
      "position": {
        "x": 400,
        "y": 520
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "path": {
          "r": 12,
          "refX": "50%",
          "refY": "50%",
          "fill": "#63ba4d",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 4
        },
        "label": {
          "text": "End",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "598f44e2-1582-486f-95f2-23fba92d9486",
      "zIndex": 1,
      "data": {
        "nodeType": "endEvent",
        "appType": "basic",
        "nodeName": "End",
        "icon": "icon-radio-off-full",
        "description": "Playbook end node"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "circle",
          "selector": "path"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "4a22f5d7-d8a1-416b-9969-019f530902f6",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "ec535172-836f-4e5e-9e4a-ef546f030f5d"
      },
      "target": {
        "cell": "598f44e2-1582-486f-95f2-23fba92d9486"
      }
    },
    {
      "position": {
        "x": -210,
        "y": 610
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "7de7117c-1da6-4d03-8a09-b761114a7b05",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "formatdata",
        "valueData": {
          "outputFields": "[{\"fieldName\":\"name\",\"fieldValue\":\"test\"},{\"fieldName\":\"age\",\"fieldValue\":\"18\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Generates new data.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "formatdata",
        "status": "success",
        "cascaderValue": [],
        "isDebug": false
      },
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "4136040c-0b42-4557-94bb-8b77b6f5f3c5",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "router": {
        "name": "normal"
      },
      "isNode": false,
      "source": {
        "cell": "StartEvent_1"
      },
      "target": {
        "cell": "7de7117c-1da6-4d03-8a09-b761114a7b05"
      },
      "vertices": [
        {
          "x": -492,
          "y": 643
        }
      ]
    },
    {
      "position": {
        "x": 71,
        "y": 625
      },
      "size": {
        "width": 36,
        "height": 36
      },
      "attrs": {
        "body": {
          "fill": "white",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 2
        },
        "path": {
          "r": 12,
          "refX": "50%",
          "refY": "50%",
          "fill": "#63ba4d",
          "strokeOpacity": 0.95,
          "stroke": "#63ba4d",
          "strokeWidth": 4
        },
        "label": {
          "text": "End",
          "fontSize": 12,
          "refX": 0.5,
          "refY": "100%",
          "refY2": 4,
          "textAnchor": "middle",
          "textVerticalAnchor": "top"
        }
      },
      "visible": true,
      "shape": "circle",
      "id": "8978b5d1-3cae-4e43-98d0-aca302555856",
      "zIndex": 1,
      "data": {
        "nodeType": "endEvent",
        "appType": "basic",
        "nodeName": "End",
        "icon": "icon-radio-off-full",
        "description": "Playbook end node"
      },
      "markup": [
        {
          "tagName": "circle",
          "selector": "body"
        },
        {
          "tagName": "circle",
          "selector": "path"
        },
        {
          "tagName": "text",
          "selector": "label"
        }
      ],
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "fe238014-7582-4482-b9d4-cf20cbc40e53",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "7de7117c-1da6-4d03-8a09-b761114a7b05"
      },
      "target": {
        "cell": "8978b5d1-3cae-4e43-98d0-aca302555856"
      }
    },
    {
      "position": {
        "x": -380,
        "y": 500
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "b300fedc-d828-413c-b593-153dbda5ed1a",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "left",
        "valueData": {
          "inputData": "[{\"action\":\"11\",\"uuid\":[{\"uuid-key\":\"1\"}]},{\"action\":\"21\",\"uuid\":[{\"uuid-key\":\"2\"}]}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Converts the input data to the JSON type. If the input is a JSONArray, all its elements are placed directly into the datalist. If the input is a JSONObject, it is treated as a single row in the datalist.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "convertToJSON",
        "status": "success"
      },
      "isNode": true
    },
    {
      "position": {
        "x": -80,
        "y": 505
      },
      "size": {
        "width": 137,
        "height": 66
      },
      "view": "react-shape-view",
      "shape": "activity",
      "id": "c5baaffa-df7e-47f4-851d-7289276ad76b",
      "zIndex": 1,
      "data": {
        "nodeType": "action",
        "appType": "component",
        "nodeName": "right",
        "valueData": {
          "inputData": "[{\"uuid\":[{\"uuid-key\":\"1\"}],\"host\":\"196.1.*.*\"},{\"uuid\":[{\"uuid-key\":\"1\"}],\"host\":\"196.2.*.*\"}]"
        },
        "icon": "https://sophon-gen-v2.oss-cn-zhangjiakou.aliyuncs.com/componentUpload/1719222281702_DataFormat_logo.png?Expires=1745373374&OSSAccessKeyId=STS.NVCS************&Signature=NG4Wh%2F2zJrendn8IhShW74ymMSA%3D&security-token=CAIS2AJ1q6Ft5B2yfSjIr5X2GMPAo6xY7venWBWHjlgyQexrpZTB1Dz2IHhMenFpAegcv%2Fw%2BlGFZ6%2F8elrp6SJtIXleCZtF94oxN9h2gb4fb4xF6LjaJ0s%2FLI3OaLjKm9u2wCryLYbGwU%2FOpbE%2B%2B5U0X6LDmdDKkckW4OJmS8%2FBOZcgWWQ%2FKBlgvRq0hRG1YpdQdKGHaONu0LxfumRCwNkdzvRdmgm4NgsbWgO%2Fks0OP3AOrlrBN%2Bdiuf8T9NvMBZskvD42Hu8VtbbfE3SJq7BxHybx7lqQs%2B02c5onDWwAJu0%2FXa7uEo4wydVNjFbM9A65Dqufxn%2Fpgt%2Braj4X7xhhEIOVJSSPbSZBbSxJNvU1RXDxQVcEYWxylurjnXvF%2BA9Gz5Y%2FUGin%2B2svzhw6RGJ1dq8DgINtD0jokjPndRVbLXs84nxS7gbsGn76oY2zradH%2FdU501DLSMytAXxqAAYnrQLesLZ0VOxi7cg9LDO9w1brCl%2Fw1TxYuVpiYFJ11Kc5F2ues4ocueMk3q3AuAFpCyXW646Exz7L86%2Bp3aiLIps5ON%2FjCiP9oG8LAXI4ajG3woQPLdwm9bT20vHi4yEJYVlvntpkk5bLR5mOuE%2B6VPgmB2q2gHJTKgj13KEDwIAA%3D",
        "description": "Converts the input data to the JSON type. If the input is a JSONArray, all its elements are placed directly into the datalist. If the input is a JSONObject, it is treated as a single row in the datalist.",
        "advance": {
          "inputParamMode": false,
          "onError": "stop_cur_flow",
          "rspStatusType": 3,
          "rspStatusThreshold": 0
        },
        "componentName": "DataFormat",
        "actionName": "convertToJSON",
        "status": "success"
      },
      "isNode": true
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "a8104b42-f869-4296-9681-f67f4f59ecef",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "router": {
        "name": "normal"
      },
      "isNode": false,
      "source": {
        "cell": "StartEvent_1"
      },
      "target": {
        "cell": "b300fedc-d828-413c-b593-153dbda5ed1a"
      },
      "vertices": [
        {
          "x": -492,
          "y": 533
        }
      ]
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "c20d8dea-c711-4cc3-b6ea-f86033954390",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "b300fedc-d828-413c-b593-153dbda5ed1a"
      },
      "target": {
        "cell": "c5baaffa-df7e-47f4-851d-7289276ad76b"
      }
    },
    {
      "shape": "custom-edge",
      "attrs": {
        "line": {
          "stroke": "#63ba4d",
          "targetMarker": {
            "stroke": "#63ba4d"
          }
        }
      },
      "zIndex": 1,
      "id": "c00c6197-85b7-486b-8771-3daa3fdb243e",
      "data": {
        "nodeType": "sequenceFlow",
        "appType": "basic",
        "icon": "icon-upper-right-arrow",
        "isRequired": false
      },
      "isNode": false,
      "source": {
        "cell": "c5baaffa-df7e-47f4-851d-7289276ad76b"
      },
      "target": {
        "cell": "ec535172-836f-4e5e-9e4a-ef546f030f5d"
      }
    }
  ]
}

joindata

Menggabungkan beberapa tabel dan menghasilkan bidang yang ditentukan.

Deskripsi parameter

Parameter	Description
inputNodes	Node yang akan digabungkan. Datanya harus dalam format JSONArray. Tidak ada batasan pada tingkat nesting. JSONArray dapat berisi beberapa JSONArray bersarang.
joinFields	Bidang yang digunakan untuk mengasosiasikan node. Formatnya adalah `[nodeName].[fieldName]`. Anda hanya dapat memilih bidang tingkat pertama di `inputNodes`. Tidak ada batasan tipe bidang. JSONArray dan String didukung. Anda tidak dapat memilih bidang dari JSONArray bersarang. Catatan Sebagai contoh, jika data `inputNodes` adalah `[{"action":"11","uuid":[{"uuid-key":"1"}]}]`, Anda dapat mengatur `joinFields` menjadi `action` atau `uuid`, tetapi bukan `uuid-key`.
outputFields	Bidang yang akan dihasilkan setelah penggabungan. Format referensinya adalah `[nodeName].[fieldName]`.

Contoh

Skenario contoh

Node data `leftJSON` dan `rightJSON` digunakan sebagai input. Format datanya sebagai berikut:
`leftJSON`: `[{"action":"11","uuid":[{"uuid-key":"1"}]},{"action":"21","uuid":[{"uuid-key":"2"}]}]`
`rightJSON`: `[{"uuid":[{"uuid-key":"1"}],"host":"196.1.*.*"},{"uuid":[{"uuid-key":"1"}],"host":"196.2.*.*"}]`
Tabel-tabel tersebut digabungkan berdasarkan bidang `uuid`.
Bidang keluaran dikonfigurasi sebagai berikut: Bidang `host` dari `rightJSON` dihasilkan sebagai bidang `myhost`, bidang `action` dari `leftJSON` dihasilkan sebagai bidang `myaction`, dan bidang `uuid` dari `leftJSON` dipetakan ke bidang keluaran `uuid`.

Parameter	Nilai parameter
inputNodes	Dua baris data dikonfigurasi sebagai berikut: Baris 1 Kotak input kiri: `leftJSON`, Kotak input kanan: `${JSONArray:leftJSON.datalist.}`. Baris 2 Kotak input kiri: `rightJSON`, Kotak input kanan: `${JSONArray:rightJSON.datalist.}`. Catatan "JSONArray:" menunjukkan bahwa parameter dikonversi ke tipe JSONArray. Jika tidak, data tidak dapat ditarik dari node sebelumnya.
joinFields	Kotak input kiri: `leftJSON.uuid`, Kotak input kanan: `rightJSON.uuid`.
outputFields	Tiga baris data dikonfigurasi sebagai berikut: Kotak input kiri: `myhost`, Kotak input kanan: `rightJSON.host`. Kotak input kiri: `myaction`, Kotak input kanan: `leftJSON.action`. Kotak input kiri: `uuid`, Kotak input kanan: `leftJSON.uuid`.

Output contoh:

[
    {
        "myaction": "11",
        "uuid": [
            {
                "uuid-key": "1"
            }
        ],
        "myhost": "196.1.*.*"
    },
    {
        "myaction": "11",
        "uuid": [
            {
                "uuid-key": "1"
            }
        ],
        "myhost": "196.2.*.*"
    }
]

groupbydata

Mengelompokkan data masukan berdasarkan kunci.

Deskripsi parameter

Parameter	Description
inputNode	Konten masukan. Formatnya harus berupa JSONArray yang berisi beberapa objek JSON.
groupByKeys	Kunci untuk pengelompokan.
outputFields	Konten yang akan dihasilkan setelah pengelompokan. Ekspresi jq didukung.

Contoh

Skenario contoh

`inputNode` berisi informasi seperti Jenis Serangan, count, dan endTime.
Bidang pengelompokan adalah `Jenis Serangan`.
Bidang keluaran dikonfigurasi sebagai berikut: Nilai `count` dijumlahkan dan dihasilkan sebagai `Jumlah Serangan`. `endTime` terbaru dipilih dan dihasilkan sebagai `Waktu Serangan Terakhir`.

Parameter	Nilai parameter
inputNode	`[ { "Attack Type": "web shell", "count": "1", "startTime": "1646115503000", "endTime": "1646115503000", "securityEventIds": "330706" }, { "Attack Type": "web shell", "count": "2", "startTime": "1646114346000", "endTime": "1646114346000", "securityEventIds": "330700" }, { "Attack Type": "application whitelist", "count": "1", "startTime": "1646114098000", "endTime": "1646114098000", "securityEventIds": "330699" } ]`
groupByKeys	Jenis Serangan
outputFields	Catatan Gunakan ekspresi jq untuk memproses data JSON `inputNode`: `.datalist \| map_values(.count)\|add\|length`: Menjumlahkan nilai `count` untuk mendapatkan total jumlah serangan. `[.datalist[].endTime\|tonumber]\|max`: Mengonversi nilai `endTime` ke angka dan mengembalikan nilai maksimum untuk mendapatkan waktu serangan terakhir. `[ { "fieldName": "Attack Count", "fieldType": "jq", "fieldValue": ".datalist \| map_values(.count)\|add\|length" }, { "fieldName": "Latest Attack Time", "fieldType": "jq", "fieldValue": "[.datalist[].endTime\|tonumber]\|max" } ]`

Output contoh:

[
    {
        "Attack Type": "web shell",
        "Attack Count": 2,
        "Latest Attack Time": 1646115503000
    },
    {
        "Attack Type": "application whitelist",
        "Attack Count": 1,
        "Latest Attack Time": 1646114098000
    }
]

concatFiledtoBatch

Mengonkatenasi nilai dari data masukan dalam batch.

Deskripsi parameter

Parameter	Description
inputField	Konten yang akan dikonkatenasi. Formatnya harus berupa JSONArray yang berisi beberapa objek JSON.
batchSize	Jumlah item yang akan dikonkatenasi dalam setiap batch. Misalnya, nilai `2` menggabungkan dua objek JSON menjadi satu. Nilai `-1` menggabungkan semua objek JSON menjadi satu.
concatStr	String pemisah. Jika Anda memerlukan spasi di sekitar pemisah, sertakan dalam tanda kutip ganda untuk mempertahankan spasi tersebut. Contoh: `" ## "`.
fieldAddPrefix	Awalan yang ditambahkan ke string hasil konkatenasi.
fieldAddSuffix	Akhiran yang ditambahkan ke string hasil konkatenasi.

Contoh

Skenario contoh:

Konkatenasi `Jenis Serangan` dari inputField dalam kelompok dua. Gunakan " ## " untuk menggabungkan data dalam setiap kelompok. Tambahkan awalan "Prefix" dan akhiran "Suffix" ke setiap kelompok.

Parameter	Nilai parameter
inputField	`[ { "Attack Type": "web shell" }, { "Attack Type": "web shell" }, { "Attack Type": "web shell" }, { "Attack Type": "application whitelist" }, { "Attack Type": "application whitelist" } ]`
batchSize	2
concatStr	" ## "
fieldAddPrefix	Before
fieldAddSuffix	Suffix

Output contoh:

[
  {
    "concatField": "PreWebShellPost\" ## \"PreWebShellPost"
  },
  {
    "concatField": "PreWebShellPost\" ## \"PreApplicationWhitelistPost"
  },
  {
    "concatField": "PreApplicationWhitelistPost"
  }
]

leftJoin

Menjalankan left join dengan node kiri sebagai tabel utama.

Deskripsi parameter

Parameter	Description
leftNode	Node kiri yang disertakan dalam penggabungan. Formatnya harus berupa objek JsonArray yang berisi beberapa objek JSON. Tidak ada batasan pada tingkat nesting. JSONArray dapat berisi beberapa JSONArray bersarang.
rightNode	Node kanan yang disertakan dalam penggabungan. Formatnya harus berupa objek JsonArray yang berisi beberapa objek JSON. Tidak ada batasan pada tingkat nesting. JSONArray dapat berisi beberapa JSONArray bersarang.
joinFields	Bidang yang digunakan untuk mengasosiasikan node. Formatnya adalah `leftNode.[fieldName]` dan `rightNode.[fieldName]`. Anda hanya dapat memilih bidang tingkat pertama di `leftNode`. Tidak ada batasan tipe bidang. JSONArray dan String didukung. Anda tidak dapat memilih bidang dari JSONArray bersarang. Catatan Sebagai contoh, jika data `leftNode` adalah `[{"action":"11","uuid":[{"uuid-key":"1"}]}]`, Anda dapat mengatur `joinFields` menjadi `action` atau `uuid`, tetapi bukan `uuid-key`.
leftOutputFilelds	Bidang yang akan dihasilkan dari node kiri. Konversi kunci didukung. Kotak input kiri untuk nama baru, dan kotak input kanan untuk bidang asli. Catatan Kedua kotak input mendukung tanda bintang (*). Tanda bintang di kotak kiri berarti tidak dilakukan konversi kunci. Tanda bintang di kotak kanan berarti semua bidang dipilih. Pisahkan beberapa bidang dengan koma (,).
rightOutputFields	Bidang yang akan dihasilkan dari node kanan. Konversi kunci didukung. Kotak input kiri untuk nama baru, dan kotak input kanan untuk bidang asli. Catatan Kedua kotak input mendukung tanda bintang (*). Tanda bintang di kotak kiri berarti tidak dilakukan konversi kunci. Tanda bintang di kotak kanan berarti semua bidang dipilih. Pisahkan beberapa bidang dengan koma (,).

Contoh

Skenario contoh

`leftNode` berisi bidang `action` dan `uuid`. Bidang `uuid` berisi data bersarang `uuid-key`. `rightNode` berisi bidang `uuid` dan `host`.
Bidang `uuid` dari `leftNode` digunakan sebagai bidang penggabungan.
Data keluaran dikonfigurasi sebagai berikut: Nilai bidang `action` dan `uuid` dari `leftNode` dihasilkan tanpa mengubah nama kuncinya. Nilai bidang `host` dari `rightNode` dihasilkan dan diganti namanya menjadi `site`.

Parameter	Nilai parameter
leftNode	Catatan Data berikut harus dikonversi ke tipe objek JsonArray terlebih dahulu. `[ { "action": "11", "uuid": [ { "uuid-key": "1" } ] }, { "action": "21", "uuid": [ { "uuid-key": "2" } ] } ]`
rightNode	Catatan Data berikut harus dikonversi ke tipe objek JsonArray terlebih dahulu. `[ { "uuid": [ { "uuid-key": "1" } ], "host": "196.1.." }, { "uuid": [ { "uuid-key": "1" } ], "host": "196.2.." } ]`
joinFields	Kotak input kiri: `leftNode.uuid`, Kotak input kanan: `rightNode.uuid`.
leftOutputFilelds	Kotak input kiri: `*`, Kotak input kanan: `action,uuid`.
rightOutputFields	Kotak input kiri: `site`, Kotak input kanan: `host`.

Output contoh:

[
  {
    "action": "11",
    "uuid": [
      {
        "uuid-key": "1"
      }
    ],
    "site": "196.1.*.*"
  },
  {
    "action": "11",
    "uuid": [
      {
        "uuid-key": "1"
      }
    ],
    "site": "196.2.*.*"
  },
  {
    "action": "21",
    "uuid": [
      {
        "uuid-key": "2"
      }
    ]
  }
]

convertToJson

Mengonversi string JSON menjadi objek JSON. Aksi ini hanya melakukan konversi tipe.

Jika string masukan berupa JSONArray, semua elemennya langsung dimasukkan ke dalam datalist.
Jika string masukan berupa JSONObject, objek tersebut diperlakukan sebagai satu baris dalam datalist.

uniondata

Menggabungkan beberapa baris data.

Deskripsi parameter

Parameter	Description
inputNodes	Data node yang akan digabungkan.

Contoh

Contoh:

Node data `left` dan `right` digunakan sebagai input. Format datanya sebagai berikut:

`left`: `[{"action":"11","uuid":[{"uuid-key":"1"}]},{"action":"21","uuid":[{"uuid-key":"2"}]}]`

`right`: `[{"uuid":[{"uuid-key":"1"}],"host":"196.1.*.*"},{"uuid":[{"uuid-key":"1"}],"host":"196.2.*.*"}]`

Parameter

Nilai parameter

inputNodes

Dua baris data dikonfigurasi sebagai berikut:

Kotak input kiri: `leftJSON`, Kotak input kanan: `${JSONArray:left.datalist.*}`.

Kotak input kiri: `rightJSON`, Kotak input kanan: `${JSONArray:right.datalist.*}`.

Catatan

Label kotak input kiri `leftJSON` dan `rightJSON` hanya berfungsi sebagai identifikasi dan tidak memiliki makna aktual.
"JSONArray:" menunjukkan bahwa parameter dikonversi ke tipe JSONArray. Jika tidak, data tidak dapat ditarik dari node sebelumnya.

Output contoh:

[
    {
        "action": "11",
        "uuid": [
            {
                "uuid-key": "1"
            }
        ]
    },
    {
        "action": "21",
        "uuid": [
            {
                "uuid-key": "2"
            }
        ]
    },
    {
        "uuid": [
            {
                "uuid-key": "1"
            }
        ],
        "host": "196.1.*.*"
    },
    {
        "uuid": [
            {
                "uuid-key": "1"
            }
        ],
        "host": "196.2.*.*"
    }
]

formatdata

Transformasi data atau mengagregasi data dari beberapa sumber.

Parameter

Parameter	Description
inputNodes	Data node yang akan diformat.

Contoh

Parameter

Nilai parameter

inputNodes

Dua baris data dikonfigurasi sebagai berikut:

Kotak input kiri: `name`, Kotak input kanan: `test`

Kotak input kiri: `age`, Kotak input kanan: `18`

Output contoh:

{
    "name": "test",
    "age": "18"
}