Validating data of an action inside a decision?

[CS_]

I'm interested in suggestions on how to tackle this. I know how I would implement it in Python, but not really sure best practice for SOAR.

Let's say I have an Action called "Lookup Host"

If it runs successfully, it returns a dict with some data
[{"hostname": "test1", "device_id": "abc123"}]

but we might actually not have data on this host, so it will return empty:
[]

I need to ensure that we have data, otherwise later playbook actions won't complete.

Would we use a decision here - like "If result != []: continue, else: exit playbook"


Here's is loosely what I want to do, but in Python Code:

result = LookupHost(hostname="test1")

if result:
    # Have a result, so can continue
    run_second_action()

else:
    # no data found, exit
    exit(0)

[CS_]

Hey @phantom_mhike 

Yeah that's more or less what i've been doing. Run action, pass to code block or custom function, if the data i need is there, return a success, have decision handle what to do if returned answer is success or not.

If that's the "accepted" way to do it, i'll soldier on with it. Thanks for the input!

[phantom_mhike · Accepted solution]

If decisions don't quite have the level of flexibility you need, you can create a validator utility that does what you propose. Run your action. pass the output to the validator, use a decision to check to see that the validator output "success", and then you can proceed to use the output from the action as needed. 

Its a little inconvenient to have plug a utility into the process but you will find several generic check scenarios that are challenging to implement with the logical capabilities in today's decisions. There are several ideas posted for how decision customizability could be improved but there are no guarantees on implementation or timeline for those yet.