Global variables

Global variables enable you to collect data from one workflow, store it, and call/use it in other workflow executions. This allows you to maintain a readily available data store (datasets).

When to use

Some common use cases for using a global variable to store data include:

• Pass event data to another workflow. For example, whether a certain task was successful or not.
• Keep a cache list. For example, a list of IPs checked by a threat intel service in the last 24 hours.
• Update a flag on a task that is waiting to be completed and check it periodically.

Usage example: IOC enrichment caching

You can use global variables to maintain a cache of IOC (indicator of compromise) enrichment results. When a new IOC is detected, check whether it was already recently enriched before going through the enrichment process.

Use the Get a variable step to retrieve the variable that would contain the enrichment result.

If the retrieval is unsuccessful, enrich the IOC and save the result in a global variable named according to the naming convention.

Available steps

The global variable steps are designed to work with arrays of values for easy accessibility and manipulation.

These are optional parameters you may find useful:

• Add the DO_NOT_RETURN_VALUE optional parameter for the Set a variable and Append to a variable steps to avoid getting the value of the variable in the step response to speed up the execution.
• Use the EXPIRES_IN optional parameter to set an expiration period when creating or modifying a variable. An expiration period can be set for a variable when updating it or appending to it, even if it was not set when the variable was created.
  

Set a variable

Creates or updates a variable (key-value pair) that can be used in any workflow execution on the workspace where the variable was created. The variable value can contain strings (text enclosed in double quotes), numbers (no quotes), arrays, and JSON objects (for example, "{"key": "value","id": 1}"). The maximum size of the value is 1 MB.

You can set the variable to expire (be deleted) at the end of a specified period, for example, 2h45m10s. The expiration period, if set, can't be removed, but it can be reset when updating or appending to the variable.

Append to a variable

Appends the specified value to the value of an existing variable. The maximum size of the value is 1 MB.

You can set or reset the variable expiration period (for example, set the variable to expire in 2h45m10s).

Get a variable

Retrieve the value of a specific variable.

The value_array output field can contain an array of values, whereas the value output field can only contain a single value (available for backward compatibility). For array variables, the value output will only get the first member of the array.

List variables

Get a list of all variables on the workspace.

Delete a variable

Permanently deletes the provided variable. It cannot be undone and might create a breaking change if the variable is used in published workflows.