Skip to main content

Incident ResponderIncident Responder Documentation

Version: i56

Add a Decision Node

When you create a playbook, you create action, decision, and filter nodes. Create a decision node to make a boolean (if/else) decision.Create a Playbook

A decision node evaluates whether the input is true or false. Based on this evaluation, the next node in the playbook executes an action.

  1. From the node you wish to make a decision on, add a node and select DECISION. If you add the node straight from the start node, it operates on all the fields and raw data in the incident.

  2. Select an input source. You can select between the fields, entities, or artifacts in the incident or the output from a previous node.

  3. Select an operator:

    • Equals – Checks if values are equal.

    • Not Equal To – Checks if values are not equal.

    • Contains – Checks if values partially match.

    • Not Contains – Checks if values do not match.

    • Is Empty – Checks if incident field doesn't have an assigned value.

    • Exists – Checks if incident field has an assigned value.

    • Starts With – Checks if string data type starts with a specified value.

    • Not Starts With – Checks if string data type doesn't start with a specified value.

    • Ends With – Checks if string data type ends with a specified value.

    • Not Ends With – Checks if string value doesn't end with a specified value.

    • In – Checks if value is in a specified list.

    • Not In – Checks if value is not in a specified list.

    • Matches – Checks if values match exactly.

    • Not Matches – Checks if values don't match exactly.

    • Greater Than – Checks if value is greater than a specified value.

  4. (Optional) If relevant, enter or select a value.

  5. Click SAVE.

  6. (Optional) Add additional conditions to the decision node.

    • To add an or condition, select +OR.

    • To add an and condition, select +AND.

  7. From the decision node's outbound ports, add a node that executes depending on how the input was evaluated:

    • To execute a node if the input is evaluated as true, add a node from the outbound port on the side.

    • To execute a node if the input is evaluated as false, add a node from the top or bottom outbound ports.

  8. To close the panel, click anywhere in the interface. If there is a red border around the node, you have not configured one or more necessary fields.