Skip to main content
Question

Secops-SOAR - Nesting placeholders

  • March 10, 2026
  • 0 replies
  • 18 views

RobDelRio

So it seems is not possible to nest placeholders in the expression builder right?

I have several fields that come with comma separated values, pretty much like field1: “value1, value2, value3”.

So I wanted to iterate over a list of items and do operations like conditions, as in “item 1 = value1”.
I created a loop and I thought in in the expression builder I could just add something like [item_list | split(“,”)] getbyindex(“[Loop.Index]”) ]

(Also adding an incremental value of -1 since loops are based 1 and positions based 0)

 

Either I’m missing something or I just need a new approach like just go ahead and code a new action in IDE.