Just getting started with SOAR and I am encountering a scenario where I obviously don't understand the concept enough. I could use a push in the right direction to understand how I'm supposed to pass output from a Splunk action block to a decision or utility block. Logic is as follows: 1. We utilize a Splunk -- Timer asset to schedule execution of playbook at certain time 2. First block is a Splunk query action block; basic SPL is  index=custom_index usernames=* | table usernames, emailAddresses, userScore 3. I want to pass the usernames to a decision block, and this is where I get lost. I see event choices, and CEF fields, etc. as options, but nothing explicitly stated for "usernames". Am I supposed to custom code a solution using action_result.data, and if so, can I get a hint on how to do so? (this wasn't covered in my creating playbooks course) Thank you ... View more