Skip to main content
Solved

Playbook: How to use Entitys on Entity Placeholders

  • July 30, 2026
  • 3 replies
  • 30 views

gabriel.marchi
Forum|alt.badge.img+1

I need a way to pass the IP address from the UDM Principal IP field to the IP field in the Akamai block, but I couldn't find the most appropriate placeholder for it.
 

 

Best answer by cmorris

Please try adding [Event.event_principal_ip_1] to the Items parameter in your Akamai action.

3 replies

whathehack81
Forum|alt.badge.img+7

If the UDM event already contains principal.ip, you normally don't need a special placeholder. Add the IP as an entity first, then reference the entity attribute in the Akamai action.

For example, if your playbook creates an IP entity from principal.ip, the Items field can reference the entity's IP value (for example, Entity.IPAddress, depending on your entity type).

If you're starting directly from a UDM event, can you share how the event is entering the playbook (Alert, Case, or Event trigger)? That determines the correct placeholder path.

 


gabriel.marchi
Forum|alt.badge.img+1

Hi! I understand the idea, but how can I create this entity?

If I use the Create Entity block, I still need to provide the IP value when creating the entity. If I already have access to that value to populate the Create Entity block, then I should also be able to pass it directly to the Akamai block.

Could you clarify which placeholder or field I should use to retrieve the value of principal.ip?

 


cmorris
Staff
Forum|alt.badge.img+16
  • Staff
  • Answer
  • July 30, 2026

Please try adding [Event.event_principal_ip_1] to the Items parameter in your Akamai action.