Commit daebf93
committed
Replace broken Pulsedive example with real console export
Retires ioc-analysis-pulsedive.yaml — it failed server-side API validation (a cs.json.decode over Inline.Python output_stdout, which release rejects) and carried stale synthetic parallel-join nodes from an older converter. Replaces it with domain-enrichment-pulsedive.yaml, a Falcon console export (Content Library playbook 8746f79b2514435db58f433fa062a4ee) that passes validate.py at all tiers.
The new example is the fan-out -> converge reference: parallel Pulsedive lookups store their real response objects into WorkflowCustomVariable (indicator_details_result, explore_indicators_result) via UpdateVariable, read by downstream comment/tag actions. Repoints the http-actions.md and README citations to it with accurate variable names.
Also refreshes the Inline.Python reference: the deleted file was its 'Full example', so the reference now carries an inline abuse.ch SSL-blocklist parsing snippet (CEL++ use case: fetch + parse a feed for a lookup file) and notes a console-verified end-to-end example is in progress. Every shipped example now passes server-side API validation.1 parent 0186cea commit daebf93
5 files changed
Lines changed: 456 additions & 493 deletions
File tree
- skills/authoring
- examples
- threat-intel
- references
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
23 | 23 | | |
24 | 24 | | |
25 | 25 | | |
26 | | - | |
| 26 | + | |
27 | 27 | | |
28 | 28 | | |
29 | 29 | | |
| |||
0 commit comments