The Google Cloud Security Community will be in read-only mode July 16 - July 22 as we migrate platforms. Read more and check out our FAQ.

[Brad_C]

Hi everyone. I'm wondering if something is possible in a playbook. If I have an action that enriches a list of entities, can I have a previous action condition that parses each entity and processes each one down the correct conditional path? Right now the conditional seems to always process just based on first entity processed by the previous action.

[Dmitry_Sarakeev]

this is what i got:

Since playbooks are linear, a condition will choose only one path, so it's not the possible like that. The correct way to do this is by using an entity selection action to create different entity scopes, and run the relevant actions on the relevant entities. If more than one action is needed, I like to create a block where the first step is the entity selection, followed by the relevant actions, and simply add it to the playbook as is.

[Brad_C]

@Dmitry_Sarakeev : is there a way to create an entity selection based on the results of an action? I need to process the IPs first to add a data point, to then determine which path needs to be traversed after that. I did try what was suggested above, but couldn't figure out how to make the entity selection conditional based on an action result.