Global variables enable you to collect data from one workflow execution, store it, and call/use it in other workflow executions. Data stored within global variables should be considered "temporary" compared to workspace variables. Unless the Expires in parameter is adjusted, global variables will be deleted after a week of creation.
When to use global variables
Pass event data: Share task status or execution results between separate workflows.
Maintain a cache list: Store recently checked IPs, IOCs, or other temporary data for quick reuse.
Track task state: Update and monitor task flags across workflow executions.
How to use
Global variable steps are designed to work with arrays for flexible access and manipulation.
Use temporary storage: Treat global variables as short-term storage compared to workspace variables.
Understand default expiration: Variables expire 7 days after creation by default.
(Optional) Adjust expiration: Set the Expires in parameter up to a maximum of 30 days.
Note legacy behavior: Older steps without expiration settings are automatically set to 30 days.
Enforce expiration limits: If a value greater than 30 days is requested, the system automatically resets the expiration to 30 days without failing the step.
(Optional) Improve performance: Enable Do not return value in the Set a variable and Append to a variable steps to speed up execution by skipping the variable value in the step response.
Available global variable steps
Set a variable
Create or update a global variable to store text, numbers, arrays, or JSON objects.
Append to a variable
Add new values to an existing global variable without overwriting previous entries. You can optionally adjust the expiration period to extend or shorten the variableâs lifespan.
Flatten arrays
Use the Concat Arrays utility step to combine multiple array objects into a single structured array for easier data management.
Get a variable
Retrieve the content of a global variable, either as a full array or as a single value for backward compatibility. The value_array output returns all stored values as an array, while the value output returns only the first item in the array.
List variables
Retrieve a list of all currently active global variables in the workspace.
Delete a variable
Permanently remove a global variable from the workspace. This action is irreversible and may impact active or published workflows that rely on the variable, so proceed with caution.
Use case: IOC enrichment caching
Before processing a new Indicator of Compromise (IOC), check whether it was recently enriched by retrieving existing results from a global variable. If enrichment data already exists, reuse it to avoid redundant processing. If no data is found, proceed with enrichment and store the results in a global variable using a consistent naming convention for future lookups.
