topic Re: sub-playbook looping behavior in Cortex XSOAR Discussions

sub-playbook looping behavior

BRowe_23 — Wed, 07 May 2025 15:24:43 GMT

Do sub-playbooks self loop on arrays or just lists?

I can get a sub-playbook to loop “for each input” of a list, but not an array of the same data.

Thx

Re: sub-playbook looping behavior

JStephan — Thu, 08 May 2025 09:26:45 GMT

Hey there,
than there might be something wrong with your data, an array and a list should look the same in the context data.
So you might need to use a transformer to adjust the input

Re: sub-playbook looping behavior

BRowe_23 — Thu, 08 May 2025 16:31:58 GMT

Thanks for the response.

If the obligatory basic ${array} or defined list "Looks Like":

[

"abc123",

"def456",

"ghi789"

]

Would that appear to be the correct format? I sent this to the sub-playbook every way that I could think of and it still only touches the sub-playbook once. I've tried various formats. The documentation suggests that it needs to be JSON, which might be more like:

[

"varName": "abc123",

"varName": "def456",

"varName": "ghi789"

]

... or this:

[

{"varName": "abc123"},

{"varName": "def456"},

{"varName": "ghi789"}

]

... or overthinking it and it should simply be this:

["abc123","def456","ghi789"]

I'd like to know what data format a sub-playbook will loop. I've had no issue addressing complex data for other playbook uses, but not a sub-playbook loop.

The documentation has no explicit documentation and video examples are hard to study. My native format of data is more complex of course, but I've boiled it down to samples literally just like this just to see if it will loop.

Clearly, I have a syntax issue. I just need a clear example of data that will loop.

Thanks

Re: sub-playbook looping behavior

JStephan — Fri, 09 May 2025 06:42:23 GMT

Hi again,

well, I guess it does not really matter, the "for each input" loop needs an itemizable list so that for each works,

easiest way to figure that out is to use the Transformer. So basically if you test with transformer we want a list coming out in the test field, if that is not the case you would need to add transformer to manipulate until you have the desired output