State

The State is a JSON object that represents the data of a running Workflow. Because the State is not strictly defined, data is dynamically stored in the State.

JSON can store almost any kind of data and allows data to be classified in subobjects. API responses are stored in JSON format and events are assembled to be sent to the pipeline in JSON.

Persistence
The State is persisted and is not lost during upgrades, restarts, and deployments of the QRadar® product.
Encryption
The State supports encryption to prevent sensitive data from being displayed.
Querying
The State can be queried with JPath, which is a JSON query language that is similar to XPath for XML. For more information, see JPath.
Template Strings
A template string is a string that can contain JPath expressions. JPath expressions are referenced by using the ${...} syntax. For more information, see JPath.

Example

You can use JPath expressions to determine a result from the following State.

{
    "some":
    {
        "value": 123
    }
}

The following table shows JPath expressions and their results.

Table 1. Template string examples
Description Template string Result
Simple value reference "The value is ${/some/value}" "The value is 123"
Arithmetic "The value is ${/some/value * 2}" "The value is 246"
Logical operations "The expression is ${/some/value > 12}" "The expression is true"
Built-in function "The current time is ${time()}ms since epoch" "The current time is 1586968388123ms since epoch"