Skip to content

Commit daebf93

Browse files
committed
Replace broken Pulsedive example with real console export
Retires ioc-analysis-pulsedive.yaml — it failed server-side API validation (a cs.json.decode over Inline.Python output_stdout, which release rejects) and carried stale synthetic parallel-join nodes from an older converter. Replaces it with domain-enrichment-pulsedive.yaml, a Falcon console export (Content Library playbook 8746f79b2514435db58f433fa062a4ee) that passes validate.py at all tiers. The new example is the fan-out -> converge reference: parallel Pulsedive lookups store their real response objects into WorkflowCustomVariable (indicator_details_result, explore_indicators_result) via UpdateVariable, read by downstream comment/tag actions. Repoints the http-actions.md and README citations to it with accurate variable names. Also refreshes the Inline.Python reference: the deleted file was its 'Full example', so the reference now carries an inline abuse.ch SSL-blocklist parsing snippet (CEL++ use case: fetch + parse a feed for a lookup file) and notes a console-verified end-to-end example is in progress. Every shipped example now passes server-side API validation.
1 parent 0186cea commit daebf93

5 files changed

Lines changed: 456 additions & 493 deletions

File tree

skills/authoring/examples/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ network containment, notifications, and more.
2323
- [Domain Enrichment VirusTotal](threat-intel/domain-enrichment-virustotal.yaml)
2424
- [IP Address Enrichment AbuseIPDB](threat-intel/ip-address-enrichment-abuseipdb.yaml) — parallel fan-out (multi-target `next:`) and input gating (`cs.ip.valid`)
2525
- [Enrich URL on-demand with VirusTotal and add to Zscaler blocklist](threat-intel/enrich-url-virustotal-zscaler-blocklist.yaml)
26-
- [IOC Analysis with Pulsedive](threat-intel/ioc-analysis-pulsedive.yaml)an `Inline.Python` action (`py0313general`) whose `output_stdout` feeds a downstream variable
26+
- [Domain Enrichment Pulsedive](threat-intel/domain-enrichment-pulsedive.yaml)fan-out → converge: parallel Pulsedive lookups store their real response objects in `WorkflowCustomVariable`, read by downstream comment/tag actions
2727

2828
### identity-response
2929

0 commit comments

Comments
 (0)