Two action blocks, geolocate_ip_1 and file_reputation_2, are connected to a decision block. Which of the following is a correct configuration for making a decision on the action results from one of…

Question

Options

• ASelect parameter set to: file_reputation_2:action_result.data.*.response_code; evaluation option
• BSelect parameter set to: geolocate_ip_1:action_result.data.*.country_iso_code; evaluation option
• CSelect parameter set to: geolocate_ip_1:action_result.cef.*.country_iso_code; evaluation option
• DSelect parameter set to: file_reputation_2:action_result.cef.*.response_code; evaluation option

• A
  12% (6)
• B
  76% (37)
• C
  8% (4)
• D
  4% (2)

Explanation

Option B is correct because it uses the proper action result data path format for Splunk SOAR decision blocks: <block_name>:action_result.data.*.<field>. The geolocate_ip_1 block genuinely returns country_iso_code within its .data.* object, making this a valid, evaluable path for a decision block.

Why the distractors fail:

• A is incorrect because response_code for a file reputation action is not surfaced at the action_result.data.* level in the data path - it lives elsewhere in the result structure (e.g., summary), so the path doesn't resolve to a usable decision value.
• C and D both substitute .cef. for .data. - CEF (Common Event Format) is a different structured field used for artifact data, not for accessing raw action output. Decision blocks must reference action_result.data.*, not action_result.cef.*.

Memory tip: Think "D for Data, not CEF" - decision blocks always use action_result.**data**.* to reach action output. If you see .cef. in the path, it's wrong for this context. Then verify the field name actually belongs to that action type (geolocation → country fields; file reputation → hash/score fields).

No community discussion yet for this question.