Actions

An action is the effect of a satisfied condition. A condition can have from zero to several actions, executed top to bottom, and each action sees what the previous ones wrote.

This page gathers what applies to every action. Each action has its own page, with its specific configuration and behavior.

Source, destination, and settings

Several actions look up one piece of data and return another. In all of them the configuration follows the same shape:

  • Source: which event fields feed the action;
  • Destination: which fields receive each result;
  • Settings: parameters specific to the action.

Each destination is individually optional: if you only need the country and not the identifier, leave the other one blank. But every action requires at least one destination filled in: an action that writes nothing anywhere would not be executed and is not accepted on save.

A result the action could not resolve leaves the destination field untouched, instead of writing an empty value. This is intentional: an empty field can still be tested by a later condition ($issuer_country == null), and no guess is better than wrong data. false and 0, on the other hand, are legitimate results and are written normally.

Fixed value or expression

The two actions that write a value, set field and set temporary variable, accept that value in two forms, chosen in a selector next to the destination:

  • Fixed value: the content is written exactly as it was typed. Nothing inside it is interpreted: in fixed value mode, $amount writes the text $amount.
  • Expression: the content is interpreted, and what gets written is the result.

Actions created before this option open in Fixed value and keep the previous behavior.

An expression can be:

Form Example
a field of the event $issuer_country
a temporary variable %bot.score
a text, number, or boolean "approved", 10, true
a join with concat concat($order_id, "-", %bot.score_cell)

The same syntax as conditions applies, with one difference: an action’s expression produces a value, not a true or false, and there are no comparisons or and/or. As in any condition, a temporary variable read in the expression must have been produced by an earlier action.

Compatible types

A text, number, or boolean written directly in the expression is validated by the destination field, exactly as a fixed value would be.

A field, a temporary variable, or a concat, on the other hand, must have a type compatible with the destination. Conversion only happens when nothing is lost:

Destination field type Accepts a value of
Text any type
Integer Integer
Decimal Decimal, Integer
Boolean Boolean
Date and time Date and time

A decimal is not written into an integer field: rounding automatically would decide, on the rule author’s behalf, what to do with the fractional part. The other direction, an integer into a decimal field, is accepted. The result of concat is always text, and so it only fits in a text field.

A temporary variable has no destination type, such that it accepts any value, including a set such as %bot.triggered_cells. Copied on its own, the set stays a set and remains usable on the right-hand side of an in. That same set cannot be written into a field, nor used inside a concat.

Absent values

An expression that only copies a value, such as $field or %variable on their own, writes nothing when that value does not exist: the destination field stays as it was, and the temporary variable remains absent. It is the same choice described above, of not replacing absent data with a guess. false, 0, and an empty text, on the other hand, are legitimate readings and are written.

A concat always writes, because it builds new text instead of copying an existing one; absent parts come in as empty.

Table of contents

  • Set field - writes a value into a field of the event
  • Set temporary variable - writes a temporary value, without persisting it in the event
  • Add to temporary variable - adds a step to a temporary counter, without persisting it in the event
  • Enrich - looks up external data and writes the result into event fields
  • Extract IP prefix - reduces an IP address to the network it belongs to
  • Add to list - adds the value of a field to an account list, with an expiration
  • Run analysis - evaluates an analysis of the event type and exposes the result
  • Record analysis - feeds an analysis's windows with the current event