Skip to main content

How to Use ifThenElse in Expression Builder to Check for Null or Empty Fields

  • May 15, 2025
  • 2 replies
  • 89 views

shubham8agar
Forum|alt.badge.img+5

I'm working with the Expression Builder in Google SecOps SOAR and trying to conditionally check if a field (e.g., block.action_Results1.JsonResult|"rows.data.text") is either null or empty.

I came across the ifThenElse(operator, comparedValue, trueResult, falseResult) function and want to use it to return a default value when the field is not populated.

What’s the correct way to structure this check using ifThenElse? or is there any short way to achieve becase when block action is failed and send empty result, output writes syntax as it is and not keep it empty, so I have to make a check before !! (Can not use condition box as there are parallel action)

2 replies

ylandovskyy
Staff
Forum|alt.badge.img+16

Hey @shubham8agar ,

I think for this use case, it's better to use the "Flow Condition" component of playbook. You can make an IF statement via it.

I am talking about this:

 


shubham8agar
Forum|alt.badge.img+5
  • Author
  • New Member
  • June 28, 2025

@staff ?