Core Node Configuration OptionsThe following table lists most of the standard node configuration contexts for retrieving, manipulating, and setting data within a flow.
|msg||This selects part of the incoming message as the source of the data. This is the typical choice.|
|boolean||Allows for the selection of a
|flow||This selects part of the flow context's saved data as the source. This information is shared with only the nodes on a given tab.|
|global||This selects part of the global context's saved data as the source. This information is shared by all nodes regardless of tab.|
|J:expression||JSONata expression language to perform a query and transform operations on the payload.|
|JSON||Allows for the specification of a JSON value.|
|number||Allows for the specification of a numeric value.|
|string||Allows for the specification of a string value.|
|timestamp||Allows for the setting of numeric timestamp at the specified location based on the milliseconds since the start of the UNIX epoch.|
Security Flow Node Configuration OptionsThe following table lists a few of the Security Flow node configuration contexts for retrieving, manipulating, and setting data within a flow. There are many more specific to certain nodes, but a few core configuration contexts are explained here.
|Do Not Update||Context meaning the node's configuration option is not updated or set when performing an update or creation operation.|
|Not Specified||Context meaning the node's configuration option is not used when performing the specified node operation.|
|Standard Alert Location||An alert ID. For example, it is used by the Azure Security Center (ASC) NL-ASC-Alerts node and Microsoft Graph Security NL-MS-Graph-Security node.|
|Standard IoCs Location||An Indicator of Compromise ID. For example, it is used by the CrowdStrike Falcon NL-CrowdStrike-IoCs.|
|Standard Report Location||A report ID or a report result object. For example, it is used by the CrowdStrike Falcon NL-CrowdStrike-Sandbox.|