References - Persistent Input Values

Owned by John Hall (Unlicensed)
Last updated: Nov 23, 2020
2 min read

Overview

This document is intended for the technical audience building an integration with the ThreatConnect Platform. This document is most applicable to someone building a Threat Intelligence Feed integration and provides specific instructions for how to implement persistent input values (such as a last_run parameter).

Follow the steps in this document in the order provided in order to implement this configuration within your integration.

Persistent Input Values

For Runtime Apps, a common desire is to have persistent values for input parameters. The specific use case for this is a running date to track the last time the app successfully completed. In general, this workflow operates in this way:

  1. When the application is launched, an input parameter of last_run exists and is populated by the execution framework if a value was previously stored.

    1. If no value is provided, your Runtime App should have a default value that will be used to allow you to follow the same code execution path.

  2. Your application performs the appropriate logic using this input parameter’s current value.

  3. After the successful completion of your logic, you should record the new value for this input parameter. This will be used on the next run of the application.

In the example above, you might use the following literal values:

  1. The app runs and, with no value for last_run specified (because this is the first run), we default to 30 days ago using self.tcex.utils.format_datetime('30 days ago').

  2. Because our application uses last_run to determine the delta for data we should acquire, our initial payload will always be 30 days in the past.

  3. Once we successfully acquire and commit this data payload, we use self.tcex.results_tc('last_run',self.tcex.utils.format_datetime('tomorrow')) to record the new value as tomorrow to be used on the next run.

Here are some important notes on using this method:

  • You can find the documentation on the suitable values and other uses for format_datetime here.

  • You can find the definition of the results_tc method here and any additional information here.

  • You must properly define the last_run input in your application.

  • You should not make the last_run parameter required in any context. The initial run of the application should have this blank so that a default value is used.

  • You should not show the last_run parameter in the Feed Deployer Wizard (if used).