Actions

Actions are the building blocks of the workflow. Each action has a specific purpose, such as calling HTTP endpoints, or posting events to the QRadar pipeline.

Abort
The Abort action aborts the workflow.
Add
The Add action adds a value to an array in the State.
CallEndpoint
The CallEndpoint action calls an HTTP endpoint.
ClearStatus
The ClearStatus action clears the runtime status of the protocol instance. This clears the status of the log source.
Copy
The Copy action copies one part of the State to another.
Create JWTAccessToken
The JWTAccessToken action creates a JSON Web Token (JWT).
Delete
The Delete action deletes an element from the State.
DoWhile
The DoWhile action loops a series of actions while a condition is true.
ForEach
The ForEach action executes a series of actions for each value in an array or object. In V1, the action works only for each value in an array.
FormatDate
The FormatDate action formats a UNIX timestamp to a date.
GenerateHMAC
The GenerateHMAC action applies an HMAC hash to a given input.
If/ElseIf/Else
The If/ElseIf/Else actions execute actions if a condition is satisfied.
Initialize
The Initialize action initializes a value in the State.
Log
The Log action logs troubleshooting messages.
Merge
The Merge action merges an array into an array, or an object into an object.
ParseDate
The ParseDate action parses a date into a UNIX timestamp.
PostEvent
The PostEvent action posts an event to the QRadar event pipeline, which allows the event to be parsed, correlated, and stored.
PostEvents
The PostEvents action posts an array of events to the QRadar event pipeline, which allows the events to be parsed, correlated, and stored.
RegexCapture
The RegexCapture action captures part of a string with a regular expression (regex).
Set
The Set action sets a value in the State.
SetStatus
The SetStatus action sets the runtime status of the protocol instance. This information appears in the status of the log source.
Sleep
The Sleep action suspends the Workflow for a specified amount of time.
Split
The Split action splits a string.
While
The While action loops a series of nested actions while a condition is true.
XPathQuery
The XPathQuery action executes an XPath query on an XML document value.

Parent topic: Universal Cloud REST API protocol