Functions and scripts
Functions provided by apps can be used to integrate with other security systems.
A function is an object that sends data to a remote app through a message destination. The app performs an activity then returns the results. Functions can be triggered by playbooks and workflows.
Many apps install functions in the Orchestration & Automation application. These functions are then used to perform sophisticated operations, such as performing lookups, sending attachments for analysis and adding the resulting report to the incident, and triggering an external action and then returning results for use in decision-making processes.
A function has one or more inputs and provides a result in JSON. You can provide static values for inputs manually or variable inputs programmatically by a script. When triggered, the function sends the input values to the remote app by way of a post to a message destination and waits for a result. You use the result as a decision point in the playbook or workflow.
When using a script to set the input value of one or more of the function’s input fields, you can use the script to retrieve the current value of a property then provide that value to the function. However, the script cannot perform such activities as changing incident values or adding artifacts.
You can have script take as input the function’s result. The script can change incident values, add artifacts, add data table rows, and more. You can also save the function’s result for use by functions later in the playbook workflow path.
You can create and manage functions in the Functions tab. Typically, app developers create functions to use with an app that can then be installed in multiple Orchestration & Automation instances.