Data Store
Query the specified Data Type, choosing the data type and
group by that you would like to see. In the future all data will be accessible through this node
Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations..
Data and error outputs
This node exposes Data and Error outputs on the canvas. You can wire the Error output to continue the runbook when the query fails and to use the structured error payload in downstream nodes. See Data and Error Outputs on Data Queries and GenAI.
Properties
Node Label: Type an informative name for the Data Store node. You can keep the system-provided default of Data Store if you wish.
Data Type
Specify which data store to query. The drop down displays the different supported data sets. You must select only one data type.
Group by
Specify which keys to use in the group by. You must select at least one group by.
Filters
Filter the query. The available filter dimensions depend on the selected Data Type and Group by. You can use properties from any previously executed node in the runbook as filter values. See How Filtering Works in Runbook Nodes and Filters.
Limit
Constrain the query by the number of objects, the metric used, and the time interval. For details, see Limits.
Metrics
Choose which metrics to collect and how they are formatted. For details, see Metric Collection.
Interval
When the selected Data Type supports time-based data, the Runbook Editor shows an Interval section. Use it to define the time range the Data Store query uses (absolute window, anchor plus duration, or a look-back from the reference time).
Use Collect Data Based on to choose how the window is built:
-
Last X Minutes/Hours/Days: Choose a preset duration. The query uses the data query reference time from the upstream trigger (or equivalent) as the end of the window and looks back over that duration, similar to a fixed look-back.
-
Start & End Times: Set Start Time and End Time separately. For each field, choose Runtime Variable or Incident Variable, then select the variable whose value supplies the boundary at run time (for example a timestamp from the incident or from an earlier node). The resolved values define the inclusive query window.
-
Start Time & Duration: Set Start Time from a runtime or incident variable, then set Duration as a static value (number and minutes, hours, or days) or from a runtime or incident variable. The query window extends forward from the resolved start by that duration.
-
End Time & Duration: Set End Time from a runtime or incident variable, then set Duration the same way as for start time and duration. The query window extends backward from the resolved end by that duration.
For incident runbooks, how downstream data queries interpret the reference instant is described with the trigger under Data Query Reference Time. See Interface Incident Runbook Node Details (and your trigger node’s help) for how primary indicator offsets and runbook execution time apply when you use the look-back mode.
Output
Show the parameters that this node receives from the preceding node in the runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook..
Advanced
Show an example of the JSON output for this data query.