JSONPath

high_alerts: ${{ TRIGGER.alerts[?(@.severity == "high")] }}
open_findings: ${{ ACTIONS.fetch_findings.result.items[?(@.status == "open")] }}

{
  "high_alerts": [{"id": "al-1", "severity": "high"}],
  "open_findings": [{"id": "f-1", "status": "open"}]
}

secondary_roles: ${{ ACTIONS.parse_event.result.included[?(@.attributes.incident_role.data.attributes.slug != "primary-role")] }}

{
  "secondary_roles": [
    {
      "attributes": {
        "incident_role": {
          "data": {
            "attributes": {
              "slug": "secondary-role"
            }
          }
        }
      }
    }
  ]
}

critical_scores: ${{ ACTIONS.lookup_users.result.users[?(@.score >= 90)] }}
recent_events: ${{ TRIGGER.events[?(@.count > 10)] }}

{
  "critical_scores": [{"name": "Alice", "score": 96}],
  "recent_events": [{"id": "evt-1", "count": 14}]
}

users_with_email: ${{ ACTIONS.lookup_users.result.users[?(@.email)] }}
alerts_with_owner: ${{ TRIGGER.alerts[?(@.owner)] }}

{
  "users_with_email": [{"name": "Alice", "email": "alice@example.com"}],
  "alerts_with_owner": [{"id": "al-1", "owner": "secops"}]
}

prod_hosts: ${{ ACTIONS.inventory.result.hosts[?(@.environment == "prod")] }}
linux_hosts: ${{ ACTIONS.inventory.result.hosts[?(@.os == "linux")] }}

{
  "prod_hosts": [{"hostname": "api-1", "environment": "prod"}],
  "linux_hosts": [{"hostname": "api-1", "os": "linux"}, {"hostname": "worker-1", "os": "linux"}]
}

owned_devices: ${{ TRIGGER.assets[?(@.owner.name == "SecOps")] }}
resolved_cases: ${{ ACTIONS.search_cases.result.items[?(@.status.name == "resolved")] }}

{
  "owned_devices": [{"id": "dev-1", "owner": {"name": "SecOps"}}],
  "resolved_cases": [{"id": "case-2", "status": {"name": "resolved"}}]
}

role_slugs: ${{ ACTIONS.parse_event.result.included[?(@.attributes.incident_role.data.attributes.slug)].attributes.incident_role.data.attributes.slug }}

{
  "role_slugs": ["primary-role", "secondary-role"]
}

open_ids: ${{ ACTIONS.fetch_findings.result.items[?(@.status == "open")].id }}

{
  "open_ids": ["f-1", "f-3"]
}

name: ${{ TRIGGER.user.name }}

{
  "name": "Alice"
}

names: ${{ TRIGGER.users[*].name }}

{
  "names": ["Alice", "Bob", "Carol"]
}

email: ${{ TRIGGER.user.email }}

{
  "email": "alice@example.com"
}

ticket_id: ${{ ACTIONS.create_ticket.result.id }}

{
  "ticket_id": "T-123"
}

first_tag: ${{ ACTIONS.lookup_tags.result.tags[0] }}

{
  "first_tag": "malware"
}

tag_names: ${{ ACTIONS.lookup_tags.result.tags[*] }}

{
  "tag_names": ["malware", "phishing", "credential-access"]
}

open_findings: ${{ ACTIONS.fetch_findings.result.items[?(@.status == "open")] }}

{
  "open_findings": [{"id": "f-1", "status": "open"}, {"id": "f-3", "status": "open"}]
}

open_titles: ${{ ACTIONS.fetch_findings.result.items[?(@.status == "open")].title }}

{
  "open_titles": ["Suspicious login", "Impossible travel"]
}