Data Formatter Tasks

1. Build and test the following playbook using the Get Current UTC Time command, ensuring that all tasks auto-run.

   

2. Click on the icon of the command task.

   

3. Navigate to the Return Data tab, then note the date time format.

   

4. Insert the following Jinja code into the data formatter task editor.

   CODE

   Date: {{ PlaybookData | jsonpath('$.["Get Current Date and Time"].returnData') | split(' ') | first }}
   
   Time: {{ 
       PlaybookData | jsonpath('$.["Get Current Date and Time"].returnData') | split(' ') | last 
       }}

   See jsonpath, split, and first.

   

   See FAQ 1 for guidance on accessing output data from an upstream command.

5. Re-test the playbook.

   

6. Click on the icon of the data formatter task, then navigate to the Return Data tab to verify that the data has been formatted.

   

1. Build the following playbook, ensuring that all tasks auto-run:

   

2. Configure Unwind Task with the following JSON Data parameter:

   JSON

   [
     { "demoKeyA1": "valueA1", "demoKeyA2": "valueA2" },
     { "demoKeyB1": "valueB1", "demoKeyB2": "valueB2" },
     { "demoKeyC1": "valueC1", "demoKeyC2": "valueC2" }
   ]

   

3. Configure Workflow Separator with the following conditional logic:

   CODE

   {% set data = PlaybookData | jsonpath('$.["Unwind Task"].contextData.data') %}
   
   {% if data | contains_key('demoKeyA1') or data | contains_key('demoKeyA2') %}
       Workflow A
   {% elif data | contains_key('demoKeyB1') or data | contains_key('demoKeyB2') %}
       Workflow B
   {% elif data | contains_key('demoKeyC1') or data | contains_key('demoKeyC2') %}
       Workflow C
   {% else %}
       Next
   {% endif %}

   See jsonpath, and contains_key.

   

4. Configure all data formatters with the following Jinja code:

   CODE

   {{ PlaybookData | jsonpath('$.["Unwind Task"].contextData.data') }}

   

5. Test run the playbook.

   

6. Open the Playbook Task Details popover for each of the data formatters.

   

7. Verify that the data has been successfully separated and prepared for each corresponding downstream workflow.

   

1. Build the following playbook, ensuring that all tasks auto-run:

   

2. Configure Demo Event with the following JSON data:

   JSON

   {
     "eventId": "edr-98765",
     "user": {
       "email": "analyst@securitylab.io",
       "username": "analyst",
       "role": "security_engineer"
     },
     "eventTime": "2025-11-05T14:22:33Z",
     "severity": "high",
     "alertType": "suspicious_login",
     "host": {
       "hostname": "WIN-10LAB01",
       "ip": "10.0.1.15"
     }
   }

   

3. Configure Get User Email with the following Jinja logic:

   CODE

   {
     "userEmail": {{ PlaybookData | jsonpath('$.["Demo Event"].returnData.user.email') | tojson }}
   }

   

4. Configure Get Event Time with the following Jinja logic:

   CODE

   {
     "eventTime": {{ PlaybookData | jsonpath('$.["Demo Event"].returnData.eventTime') | tojson }}
   }

   

5. Configure Get Severity with the following Jinja logic:

   CODE

   {
     "severity": {{ PlaybookData | jsonpath('$.["Demo Event"].returnData.severity') | tojson }}
   }

   See jsonpath.

   

6. Test run the playbook.

   

7. Open the Playbook Task Details popover for each of the "Get" data formatters.

   

8. Verify that the data has been successfully extracted and ready for each corresponding downstream workflow.

   

Commonly used output data fields:

Reference structure:

{{ PlaybookData | jsonpath('$.["<Task Name>"].<Parent Key>.<Child Key>') }}

• PlaybookData: The root object containing all task data within the playbook execution.

• jsonpath(): A Jinja filter that extracts data using a JSONPath expression.

• <Task Name>: The exact name of the upstream task being referenced (case-sensitive).

• <Parent Key>: An object (e.g., returnData) that holds one or more key-value pairs, where each value can be a primitive, an array or another object.

• <Child Key>: A subordinate key within the parent object that provides access to a specific data element or deeper nested structure.

READER NOTE

The Format Builder and Data Source features can help speed up the construction of the reference structure.