Flow condition in Chronicle SOAR not working

Hi All,

I have a block for log collection, where I am using a flow to check whether the UDM action JSON is not empty. If it isn't, I add a CSV case wall attachment. However, I noticed that the UDM result is empty, yet it is still routing to branch one, even though the condition is set to proceed only if the JSON is not empty.

vanitharaj1208_0-1736970959895.pngvanitharaj1208_1-1736971016927.png

 

 

Solved Solved
0 6 389
1 ACCEPTED SOLUTION

JSON Result might still exist as empty list, which I believe is the situation here. So, if you want to create a stable condition, then my suggestion would be to do:

ylandovskyy_0-1747822868804.png

As "{" will only exist if JSON Result contains an actual JSON object inside of it.

 

View solution in original post

6 REPLIES 6