When building playbooks for Chronicle SOAR, I often run into a limitation around looping logic. Specifically, there doesn’t appear to be a supported way to create nested loops (a loop within another loop).
This becomes an issue in fairly common use cases. For example:
- Iterating over all entities of a specific type in a case, and then looping through the values of a particular field for each entity.
- Looping through all alerts associated with a case, and within that loop, iterating through each alert’s entities or a specific type of entity.
These types of nested iterations are typical in automation workflows, so I’m curious about the rationale behind the current limitation. Is there a design or technical reason nested loops aren’t supported today, and is this functionality something Google plans to add in the future?