​
What you’ll learn

By the end of this tutorial, you’ll learn how to:

  • Define if-conditions in your workflows
  • Define any / all conditions in your workflows
  • Run actions in a loop

​
If-conditions

View all supported binary operators (e.g. ==, >,in) in the functions cheatsheet.

Every action can be turned into a conditional action. Under the If condition / Loops tab, you can specify a condition that determines whether the action should be executed.

For example, to run the Get result action only if the URL submission was successful, go to the If condition / Loops tab and specify the following in the Run if input:

${{ ACTIONS.scan_url.result.data.message == "Submission successful" }}

Examples

Conditional expressions are one of the most powerful features in Tracecat. Combine binary operators and in-line functions to express complex conditions with ease.

Here are examples of commonly used conditional expressions.

# Check if condition is True
${{ bool(ACTIONS.is_enabled.result) }}

# Check if condition is False
${{ bool(ACTIONS.is_locked.result) }}

# Note: If the condition is already truthy
# or falsy there's no need to use bool()
${{ ACTIONS.is_enabled.result }}

You can also combine multiple conditions using the && and || operators:

Combined Conditions
# Check if user is admin and CPU usage is high
${{ ACTIONS.user_role.result == "admin" && ACTIONS.cpu_usage.result >= 90 }}

# Check if either memory or CPU usage is critical
${{ ACTIONS.memory_usage.result >= 95 || ACTIONS.cpu_usage.result >= 95 }}

​
Any / All Conditions

Consider the case where you have multiple upstream actions that connect to one downstream joining node. You can control whether the joining node should run if all or any of the upstream actions succeed or fail.

Configure this by going to the If condition / Loops tab of the joining node and setting the join_strategy option to all or any.

​
Loops

Every action can be turned into a looped action. Under the If condition / Loops tab, you can specify loop expressions to iterate over a list of items and run the action for each item.

You can loop over any list of items in your workflow context. For example, it can be a list of file hashes in a previous action ACTIONS.some_intel_feed.result.data.malware_samples or a list of items received via webhook in TRIGGER.

Example

1

Define the loop

Define a loop expression using the ${{ for var.some_variable_name in some_list }} syntax. The variable name can be anything you want, but we recommend using a name that makes sense for the items in the list.

In this example, we iterate through a list of numbers send via webhook in TRIGGER.

${{ for var.number in TRIGGER.numbers }}

2

Use the loop variable

Go back to the action’s Inputs tab. You can now use the loop variable in the action’s inputs using the ${{ var.some_variable_name }} syntax. During the workflow run, each var.some_variable_name in the loop expression is replaced with the current item in the list.

In this example, we use the loop variable in core.transform.reshape action to iterate through a list of numbers and add one to each number.

value: ${{ var.number + 1 }}

3

Run workflow

Run the workflow via UI with the payload {"numbers": [1, 2, 3]} to see the loop in action.

The core.transform.reshape action will be executed three times with var.number being 1, 2, and 3 respectively and the output will be [2, 3, 4].