Game Over
- Sarah Bigault (Deactivated)
Description
This unit is a Processor unit.
This unit prompts a Flow to stop or delete itself when the task is complete.
An event is entering through the stop port will signal current flow to stop, whereas an event entering via the delete port will signal the entire Flow to delete itself.
If the evaluation produces an error, the event is sent to the error port.
Configuration
After dragging this unit into the Flow canvas, double-click it to access its configuration options. The following table describes the configuration options of this unit:
Tab | Field | Description |
|---|---|---|
General | Name | Enter a name for the unit. It must start with a letter, and cannot contain spaces. Only letters, numbers, and underscores are allowed. |
Description | Enter a description detailing the scope of the unit. |
Input ports
Port | Description |
|---|---|
stop | All events entering through this port will prompt the Flow to stop. |
delete | All events entering through this port will prompt the Flow to delete itself. |
Output ports
Port | Description |
|---|---|
error | This port outputs events that generated an error when evaluated against the condition. Standard error fields (error, exception) are added to the output events. |
Example
In this example, we want to send events related to a single user in our domain from the siem.logtrust.web.activity table to a new my.app table, and once received, delete the Flow.Â
To do it, we will use a Devo source unit to get events from the siem.logtrust.web.activity table. Then, we will link it to a Filter unit that will only send events containing the email of the required user. Then, we will link its out output port to a Devo sink unit to send the filtered events to a my.app table. Finally, we add the Game Over unit and delete the entire Flow.
Download this example
You can try this flow by downloading this JSON and uploading it to your domain using the Import option:
Â