I'm working with Google SecOps (Chronicle SOAR) playbooks, and I've noticed that when an action fails, the output sometimes still shows the expression in its raw form, like:
[Action_Name_Get Question Results_1.JsonResult]
Instead of resolving to None or an empty string, it just stays as-is. This causes issues when referencing the output in later steps or logs.
My questions are:
- Is this the expected behavior when an action fails?
- What’s the best practice to handle such cases ?
- Are there any built-in functions or patterns in SecOps playbooks to gracefully handle failed action outputs?
