Iteration

The Iteration node Individual components that make up a runbook automation, each performing a specific function such as data queries, transformations, logic, integrations, or visualizations. runs a nested node once for each row in the parent dataset. Use the Iteration node in a runbook An automated workflow that executes a series of steps or tasks in response to a triggered event, such as the detection of anomalous behavior generating an incident, a lifecycle event, or a manually executed runbook. when you have a list of entities, such as devices, and you want the same action to run against every row.

Typical uses include the following:

• Walk a list of devices and call an external command or configuration system for each device.

• Run an HTTP (Hypertext Transfer Protocol Hypertext Transfer Protocol. A protocol used for transmitting data over the internet, commonly used in webhook runbooks and integrations with external systems.) request once per row to add location, importance, or similar attributes.

• Call a subflow A reusable automation chunk that performs frequently used functions, such as opening a ticket in an external system, and can be used to implement integrations with third-party systems. once per row so a reusable set of steps repeats for every entity Things deployed in the customer environment that are needed to run the business, such as applications, devices, interfaces, and locations..

The Iteration node must have exactly one parent. The editor reports an error if the node has no parent or more than one parent. The parent supplies the rows that the inner node iterates over.

Inner node

The inner node is the nested step that runs once per input row. The following inner node types are supported:

• HTTP Request: Runs one HTTP request per input row.

• Subflow: Runs one subflow per input row.

The following inner node types are not supported: Transform, GenAI, Agentic AI, and Data Query.

Data and error outputs

The Iteration node has two outputs on the canvas, labeled data and error. Wire the success path to the data output. Wire a dedicated failure path to the error output when you want the runbook to continue after an inner execution fails. For how those outputs behave, see Data and Error Outputs on Data Queries and GenAI.

The data output A document containing data sets generated by the execution of a runbook, including output of queries and reports from point products, as well as output of analysis or other runbook nodes. uses the context of the inner node. If the inner node is not set, the Iteration node has no keys or metrics of its own.

Limits

Each iteration creates additional node executions. If the inner node is a subflow, the nodes inside that subflow execute for every row. A runbook has a maximum number of node executions. Keep the parent list and the inner work small enough that the run stays within that limit.

Each iteration can also add to the size of the result. A large parent list combined with a large inner result can produce a very large output. Limit the parent rows, or keep the inner node result small, when you iterate over many entities.

Properties

Node Label: Type an informative name for the Iteration node. You can keep the system-provided default of Iteration if you wish.

Timeout: Type how long the Iteration node can wait for inner executions to finish, in seconds. The default is 300 seconds.

Inner node: The nested HTTP Request or Subflow that runs once per parent row.

Debug: Select Debug if you want to receive debug data when the node executes.

Runbook compatibility

You can use the Iteration node in the following runbook types:

Incident, Lifecycle, On-Demand, External (Webhook), and Subflow.