Skip to main content
Solved

Playbook - Enrich and create insight for multiple users

  • November 18, 2025
  • 7 replies
  • 84 views

Forum|alt.badge.img+2

Hi,

I’m trying to enrich user(s) with action “Enrichment - Enrich Entity From JSON” and create an insight with action “Siemplify - Add Entity Insight”.

This is working fine with only one user, but when there are multiple users, and so, multiple “User Name” entities, this is not working.

The problem is that the targeted entities can’t be restricted to the loop item. The 2nd user information will be applied to all existing entities.

eg: 

I have 2 users (user A and user B), 

user A is being enriched and create an insight as expected, but then

user B overwrite the enrichment of user A, and create 2 insights: one for user A and one for user B, with user B information.

 

Is there any workaround ? Or this is a known limitation that we can’t select target entities based on Loop Item?

 
 
 

Best answer by ylandovskyy

@Gooble ,

Understood. It’s true, updating the properties of multiple entities is tricky. I can only see to have multiple “Update” actions running in parallel and have a loop iterating over entities.

7 replies

Forum|alt.badge.img+2
  • Author
  • New Member
  • November 18, 2025

So, I could bypass the issue for the user entity insight panel with the action “Siemplify - Add General Insight“, inside a loop. But the insight panel won't be truly mapped to the user entity. 
But the action "Create Entity Insight From JSON" will work inside a loop.

 

Any idea for same logic but with entities enrichment?


Forum|alt.badge.img+2
  • Author
  • New Member
  • November 19, 2025

So it seems the only action that would work for the enrichment part is the action “Enrichment - Enrich Entities from List with Field”, because it seems to be the only one that can map the Loop.Item as identifier. Which is annoying since it will work just for one field. So to enrich the users with ten fields, I would need to repeat this action 10 times.

 

That would be great to update the different SOAR actions to work properly inside a loop, and not be restricted to “All entities”.

ylandovskyy
Staff
Forum|alt.badge.img+16
  • Staff
  • November 20, 2025

Hey ​@Gooble ,

Is there a specific reason, why you are using Insights vs Widgets?


Forum|alt.badge.img+2
  • Author
  • New Member
  • November 20, 2025

Hi ​@ylandovskyy 

I’m working in a block, because I’m passing arguments. The block (user enrichment) is re-used in multiple playbooks.

It seems, if I’m not mistaken, that the view capability (widget) is not available inside block.


ylandovskyy
Staff
Forum|alt.badge.img+16
  • Staff
  • November 20, 2025

@Gooble ,

It’s not available inside the block, but you can render the block output in the widget, if needed. Also, there is a PowerUp called “Template Engine”, which can be leveraged to build more sophisticated views using Jinja engine.


Forum|alt.badge.img+2
  • Author
  • New Member
  • November 20, 2025

oh thanks ​@ylandovskyy , I wasn’t aware that the block output could be used in a widget. 

But this would work to replace the insight. 

As it comes to enriching the user on the SOAR side, to have information in the entity explorer for example, it seems not to have a simple solution when handling multiple users. The second user will overwrite the first user enrichment, the third user will overwrite the second and first user enrichment ...  Unless using the action “Enrichment - Enrich Entities from List with Field”, which is limited to one field.


ylandovskyy
Staff
Forum|alt.badge.img+16
  • Staff
  • Answer
  • November 20, 2025

@Gooble ,

Understood. It’s true, updating the properties of multiple entities is tricky. I can only see to have multiple “Update” actions running in parallel and have a loop iterating over entities.