Node Reference

Guardian Ops provides various processing nodes that can be used to build custom workflows across inbound processing flows, case workflows, and playbooks. Each node performs a specific function to help you automate your abuse management processes.

​

Universal Nodes

These nodes can be used across multiple Guardian Ops features:

​

True False Node

The True/False node provides conditional logic branching with two output paths. The path taken depends on a configurable condition that is evaluated when the node executes. Features:

• Evaluate conditions based on event or case data
• Route workflows along different paths based on the result
• Support for complex conditional expressions

​

Delay Node

The Delay node schedules events or cases for processing after a specified time period.

• Delays processing by a configured time period
• Resumes workflow execution after the delay
• Supports various time units (minutes, hours, days)
• Useful for implementing waiting periods or scheduling

​

Divider Node

The Divider node provides visual separation and documentation for complex workflows.

• Adds visual dividers to organize workflow sections
• Supports custom labels and comments for documentation
• Helps break down complex workflows into logical segments
• Improves workflow readability and maintenance

​

Inbound Processing Only Nodes

These nodes are specifically designed for inbound processing workflows:

​

IP Resolver Node

The IP Resolver node maps IP addresses from events to customer IDs for customer identification.

• Takes the event’s IP address and sets it as the customer ID
• Preserves the original ip value
• Enables customer- and case based aggregation

​

Static Resolver Node

The Static Resolver node allows you to map any field from the event data to customer, tenant, or contract identifiers. This is particularly useful when forwarding custom data through protocols like XARF. Features:

• Map any event field to customer ID, tenant ID, or contract ID
• Flexible field selection from event payload
• Ideal for custom data forwarding scenarios
• Supports XARF and other custom event formats
• Multiple field mappings per node

Use Cases:

• Forwarding custom identifiers through XARF reports
• Mapping proprietary event fields to Guardian Ops entities
• Handling events with non-standard customer identification

​

API Resolver Node

The API Resolver node integrates with your APIs to gather meta information. That data can be assigned to the Guardian Ops customer, contract or tenant entities. Features:

• Connects to external APIs
• Enriches Guardian Ops entities with additional meta data
• Supports configurable field mapping
• Automatic retry logic with exponential backoff (up to 32 hours)

Configuration:

• API resolvers must be configured before adding to workflows
• Mapping is configured at the node level
• Changes to API resolver configuration affect all workflows using that resolver

​

Tag Node

The Tag node adds custom tags to events for categorization and filtering.

• Adds tags to events
• Supports multiple tags per node
• Useful for event classification and routing

​

Drop Node

The Drop node entirely removes events from further processing.

• Completely removes events from the workflow
• Events are not saved or processed further
• Useful for filtering out unwanted event types
• Helps reduce noise in your abuse desk

​

Case Group Node

The Case Group node assigns events to cases based on configurable rules.

• Groups related events into cases
• Applies case grouping rules and logic
• Enables case-based workflow automation (playbooks)

​

Playbook Only Nodes

These nodes are specifically available for playbook workflows:

​

API Caller Node

The API Caller node makes HTTP requests to your APIs with configurable payloads. Features:

• Call external APIs with case data
• Configurable payload mapping
• Support for both JSON and form data
• Response capture and case data integration
• Automatic retries

​

Wait Until Node

The Wait Until node waits for a specific condition to become true or until a maximum timeout is reached.

• Two output paths: condition met and time elapsed
• Configurable maximum wait time
• Cases remain in wait state until condition is met or timeout occurs

​

Manual Node

The Manual node allows abuse desk agents to make manual decisions in automated workflows when human judgment is required. When a case reaches a manual node, the workflow pauses and waits for an agent to select one of the configured decision paths. Features:

• Configure 2-4 custom decision paths per node
• You can drop any available playbook node on the paths provided by the Manual Node
• Customize the name and description for each path
• Cases requiring decisions are highlighted in the Manual Decision tab
• Agents select the appropriate path in the case detail view

How It Works:

1. Case Arrival: When a case hits the manual node, it appears in the Manual Decision tab with a red indicator
2. Agent Review: Agents review case details and select the appropriate path
3. Workflow Continuation: The case proceeds along the selected path

Manual Decision Workflow: When cases require manual decisions, they appear in a dedicated tab in the cases list: Agents can then select the appropriate path directly in the case detail view: Use Cases:

• Quality control checkpoints in automated workflows
• Cases requiring external verification or research
• Decisions that need human judgment or policy interpretation
• Escalation points for complex or sensitive cases

​

Email Notification Node (coming soon)

The Email Notification node sends automated email notifications with templated content combined with data from within Guardian Ops. Features:

• Send emails from Guardian Ops
• Email composition including case, customer and api call response data
• Template engine for flexible email formatting

​

Trigger Node (coming soon)

The Trigger node provides external trigger points for workflow progression.

• Allows external systems to trigger workflow continuation through API request
• Useful for action and intervention through external system integrations
• Enables complex multi-system workflows

​

Resolve Case Node

The Resolve Case node marks cases as resolved and completes the case lifecycle.

• Marks cases as resolved
• Completes the case processing workflow
• Updates case status and metadata
• Final step in automated case resolution

​

Node Configuration

Nodes can be configured with various parameters depending on their type:

• Conditions: Boolean expressions for True/False and Wait Until nodes
• Time periods: Duration settings for Delay and Wait Until nodes
• API endpoints: URL and authentication for API Resolver and API Caller nodes
• Field mappings: Data transformation and enrichment settings
• Tags: Custom labels for categorization

Refer to the in-app documentation for specific configuration options for each node type.