Run steps in parallel

Security operations require running multiple processes at the same time. 

For example, when investigating an incident, you'll want to enrich indicators using multiple vendors at the same time. 

How to run steps in parallel

Drag a step and drop it over another step to create a parallel branch. A branch can consist of a single step or an entire log pattern (set of steps).

The parallel branches are executed concurrently (at the same time) during the workflow run.

The execution of all parallel branches has to complete for the workflow to continue.

Enrich a suspicious IP address (example)

Instead of sending indicators to a single threat intel vendor at a time and waiting for the results before continuing the workflow, you can run parallel enrichments. 

Running steps concurrently will reduce total execution time, which will vary depending on whatever the "slowest" step is.

Create parallel branches

Drag a step and drop it on the step you want to run in parallel. You can create as many branches as needed.

Get information during the parallel execution

A Slack messagethat summarizes the information received from a vendor is sentimmediately after the vendor data is returned. You will get Slack messages as the information from the vendors becomes available, in an unknown order.

Access output of the parallel branches

The steps following the parallel branches will be executed only after all branches finish executing. 

All subsequent steps in the workflow can access the output from the parallel branches.

In this example, the Exit step provides a summary of the information received from all threat intel vendors.

Important to know

• When a step executed in a parallel branch fails, the workflow will fail. If you want to ignore the failure of a branch, set the Ignore failure option to Yes.
  
• When a loop contains parallel branches, you can't use a Break operator. The Break operator should only be used in the same branch as the loop it's being used for.