And | Core | Returns true if all terms are true |
ArrayConcat | Core | Concatenates arrays or streams of entities |
ArrayDistinct | Core | Removes duplicate elements in an array or entities in an entity stream. By default, all entity properties are used to determine duplicates. This behaviour can be changed by using the KeySelector parameter. |
ArrayElementAtIndex | Core | Gets the array element at a particular index. The first element has an index of 0. |
ArrayFilter | Core | Filter an array or entity stream using a conditional statement |
ArrayFind | Core | Gets the first index of an element in an array. The index starts at 0. Returns -1 if the element is not present. |
ArrayFirst | Core | Gets the first element of an array or entity stream |
ArrayGroupBy | Core | Group elements in an array or entities in a stream using a function. Entities in the resulting array will have two properties Key and Values . The Key will be set according to the result of the function. |
ArrayIsEmpty | Core | Checks if an array is empty. |
ArrayLast | Core | Gets the last element of an array or entity stream |
ArrayLength | Core | Counts the elements in an array or entities in an entity stream. |
ArrayMap | Core | Map each element of an array or entity stream to a new value. This Step can be used to update elements of an array, or to update entity property values. The new value must have the same type as the original value. |
ArrayNew | Core | Represents an ordered collection of objects. |
ArrayReverse | Core | Reverse the order of elements in an array |
ArraySkip | Core | Skip the first n elements of an array or entity stream |
ArraySort | Core | Reorder an array or entity stream |
ArrayTake | Core | Take the first n elements of an array or entity stream |
AssertEqual | Core | Asserts that two objects are equal. Both objects must have the same type. |
AssertError | Core | Returns success if the ValueIf step returns an error and a failure otherwise. |
AssertTrue | Core | Returns an error if the nested step does not return true. |
AutopsyAddDataSource | TSK | Add a Data Source to an Autopsy Case |
AutopsyCreateNewCase | TSK | Creates a new Autopsy Case |
AutopsyGenerateReports | TSK | Generate Reports |
AutopsyListDataSources | TSK | List all Data Sources in an Autopsy Case. The result is written to the 'Command Output' folder in the case |
CharAtIndex | Core | Gets the letter that appears at a specific index. First letter is at index 0. |
Clone | Core | Creates an array by cloning an element. |
ConvertSizeUnits | Core | Convert a string representing a data size to a string representing the same size but with different units. |
CreateMsSQLConnectionString | Sql | Creates an MSSQL connection string |
CreateMySQLConnectionString | Sql | Create a database connection string for a MySQL database. |
CreatePostgresConnectionString | Sql | Creates a PostgreSQL connection string |
DateToString | Core | Converts a date to the specified format, yyyy/MM/dd HH:mm:ss by default. If no date is specified, uses the current date and time. |
Delay | Core | Delay for a specified amount of time |
DeleteItem | FileSystem | Deletes a file or folder from the file system. |
DirectoryCopy | FileSystem | Copy a directory |
DirectoryCreate | FileSystem | Creates a new directory in the file system. Will create all directories and subdirectories in the specified path unless they already exist. |
DirectoryExists | FileSystem | Returns whether a directory on the file system exists. |
DirectoryGetItems | FileSystem | Gets all items in a directory |
DirectoryMove | FileSystem | Move a directory |
Divide | Core | Divide an integer by a list of integers |
DocumentationCreate | Core | Generates documentation for all available steps. |
DoNothing | Core | Does nothing. |
DoubleDivide | Core | Divide a double by a list of doubles |
DoublePower | Core | Raises a double to the power of a list of integers sequentially |
DoubleProduct | Core | Calculate the product of a list of doubles |
DoubleSubtract | Core | Subtract a list of numbers from a number |
DoubleSum | Core | Calculate the sum of a list of doubles |
EntityCombine | Core | Combine two entities. Property values of the second entity will be prioritized. |
EntityFlatten | Core | Recursively flatten an entity, turning all nested entities into separate fields |
EntityFormat | Core | Formats an entity or an array of entities as a string |
EntityGetProperties | Core | Gets the names of all properties of an entity |
EntityGetValue | Core | Gets the value of a property from an entity |
EntityHasProperty | Core | Checks if an entity has a particular property. |
EntityMapProperties | Core | Rename entity properties. |
EntityRemoveProperty | Core | Returns a copy of the entity with the specified property removed |
EntitySetValue | Core | Returns a copy of the entity with this property set. Will add a new property if the property is not already present. |
EntityValidateRelations | Core | For each entity in the stream, check that the value of the ParentIdProperty is the value of the IdProperty for at least one entity in the stream. |
Equals | Core | Returns true is all terms are equal |
FileCopy | FileSystem | Copy a file |
FileExists | FileSystem | Returns whether a file on the file system exists. |
FileExtract | FileSystem | Extract a file in the file system. |
FileMove | FileSystem | Move a file |
FileRead | FileSystem | Reads text from a file. |
FileWrite | FileSystem | Writes a file to the local file system. |
For | Core | Do an action for each value of <i> in a range. |
ForEach | Core | Do an action for each element in an array |
FromConcordance | StructuredData | Extracts entities from a Concordance stream. The same as FromCSV but with different default values. |
FromCSV | StructuredData | Extracts entities from a CSV stream. The same as FromConcordance but with different default values. |
FromIDX | StructuredData | Create an entity from an IDX Stream |
FromJson | StructuredData | Extracts the entity from a Json stream containing a single entity. |
FromJsonArray | StructuredData | Extracts entities from a Json stream containing an array of entities. |
FromSinger | Singer | Extracts the data from a Singer Tap and converts it to entities |
FromXml | StructuredData | Extracts the entity from a Xml stream containing a single entity. |
FromXmlArray | StructuredData | Extracts entities from a Xml stream containing an array of entities. |
FromYaml | StructuredData | Extracts the entity from a Yaml stream containing a single entity. |
GetApplicationVersion | Core | Gets the current version of the application |
GetAutomaticVariable | Core | Gets the value of the automatic variable |
GetConnectorInformation | Core | Gets information about connectors |
GetImageFormat | Tesseract | Gets the image format implied by the file extension of the file name. Note that this does not actually look at the file. |
GetSettings | Core | Get an entity containing SCL settings |
GetVariable | Core | Gets the value of a named variable. |
GreaterThan | Core | Returns true if each term is less than the next term |
GreaterThanOrEqual | Core | Returns true if each term is greater than or equals to the next term |
Hash | Core | Produce a hash for some data using the specified hash algorithm |
HttpRequest | Core | Makes a Http Request to download data from the web. Returns a StringStream containing binary encoded data. |
If | Core | Executes a statement if a condition is true. |
IncrementVariable | Core | Increment an integer variable by a particular amount |
IsNull | Core | Checks if a step returns null |
LessThan | Core | Returns true if each term is less than the next term |
LessThanOrEqual | Core | Returns true if each term is less than or equals to the next term |
Log | Core | Write a value to the logs |
M365ChannelMessagesRead | Microsoft365 | Reads M365 Channels Uses /teams/{teamId}/channels/{channelId}/messages endpoint |
M365ChannelsRead | Microsoft365 | Reads M365 Channels Uses /teams/{teamId}/allChannels endpoint |
M365ChatsRead | Microsoft365 | Read User mail from Microsoft 365. Uses /Chats endpoint |
M365GetToken | Microsoft365 | Gets the M365 Token that was used to login. |
M365Login | Microsoft365 | Login to M365. You do not need to do this. |
M365MailRead | Microsoft365 | Read User mail from Microsoft 365. Uses /me/mailFolders('{Folder}')/messages endpoint |
M365TeamsRead | Microsoft365 | Read a list of users from Microsoft 365 Uses /me/joinedTeams endpoint |
M365UsersRead | Microsoft365 | Read a list of users from Microsoft 365 Uses /users endpoint |
Modulo | Core | Modulo a number by a list of integers sequentially |
Not | Core | Negation of a boolean value. |
NotEquals | Core | Returns true if each term is not equal to the next term |
NuixAddConcordance | Nuix | Adds data from a Concordance file to a NUIX case. |
NuixAddItem | Nuix | Adds a file or directory to a Nuix Case. |
NuixAddToItemSet | Nuix | Run a search query in Nuix and add all items found to an item set. Will create a new item set if one doesn't already exist. |
NuixAddToProductionSet | Nuix | Run a search query in Nuix and add all items found to a production set. Will create a new production set if one with the given name does not already exist. |
NuixAnnotateDocumentIdList | Nuix | Annotates a document ID list to add production set names to it. |
NuixAssertPrintPreviewState | Nuix | Checks the print preview state of the production set. |
NuixAssignCustodian | Nuix | Run a search query on a nuix case and assign found items to a custodian. |
NuixCloseConnection | Nuix | Close the connection to nuix. Also closes all cases |
NuixCountItems | Nuix | Returns the number of items matching a particular search term |
NuixCreateCase | Nuix | Creates a new case and opens it. |
NuixCreateIrregularItemsReport | Nuix | Creates a list of all irregular items in a case. The report is in CSV format. The headers are 'Reason', 'Path' and 'Guid' Reasons include 'NonSearchablePDF','BadExtension','Unrecognised','Unsupported','TextNotIndexed','ImagesNotProcessed','Poisoned','Record','UnrecognisedDeleted','NeedManualExamination', and 'CodeTextFiles' Use this inside a WriteFile step to write it to a file. |
NuixCreateNRTReport | Nuix | Create a case report using an NRT file. |
NuixCreateReport | Nuix | Creates a report for a Nuix case. The report is in csv format. The headers are 'Custodian', 'Type', 'Value', and 'Count'. The different types are: 'Kind', 'Type', 'Tag', and 'Address'. Use this inside a WriteFile step to write it to a file. |
NuixCreateTermList | Nuix | Creates a list of all terms appearing in the case and their frequencies. The report is in CSV format. The headers are 'Term' and 'Count' Use this inside a WriteFile step to write it to a file. |
NuixDoesCaseExist | Nuix | Returns whether or not a case exists. |
NuixExcludeDecryptedItems | Nuix | Excludes password protected items once they have been decrypted. This only excludes encrypted original items that have a decrypted child with the same name. |
NuixExportConcordance | Nuix | Exports a production set in Concorfance format |
NuixExtractEntities | Nuix | Extract Entities from a Nuix Case. |
NuixGeneratePrintPreviews | Nuix | Generates print previews for items in a production set. |
NuixGetAuditedSize | Nuix | Calculate the total audited size for a case. For this to work, the case material needs to have been ingested with the calculateAuditedSize=true processing setting. Nuix uses 1000 base for kb/mb/gb, not 1024. |
NuixGetCaseDetails | Nuix | Returns an Entity with information about the current case. Includes Name, Description, GUID, Investigator, InvestigationTimeZone, Users, Custodians, Tags, Languages, Location (path), and if available the earliest and latest dates. |
NuixGetItemProperties | Nuix | A step that the searches a case for items and outputs the values of item properties. The report is in CSV format. The headers are 'Key', 'Value', 'Path' and 'Guid' Use this inside a WriteFile step to write it to a file. |
NuixGetLicenseDetails | Nuix | Returns an Entity with information about the Nuix license currently in use. Includes license type, description, exprity, number of available workers, and the available features. The features list can be used when configuring the Nuix Connector. |
NuixGetVersion | Nuix | Returns the Nuix version |
NuixImportDocumentIds | Nuix | Imports the given document IDs into this production set. Only works if this production set has imported numbering. |
NuixMigrateCase | Nuix | Migrates a case to the latest version if necessary. |
NuixOpenCase | Nuix | Migrates a case to the latest version if necessary. |
NuixOpenConnection | Nuix | Open the connection to nuix. Does not open the case. |
NuixPerformOCR | Nuix | Performs optical character recognition on items in a NUIX case. |
NuixRemoveFromItemSet | Nuix | Removes particular items from a Nuix item set. |
NuixRemoveFromProductionSet | Nuix | Removes particular items from a Nuix production set. |
NuixReorderProductionSet | Nuix | Reorders and renumbers the items in a production set. |
NuixRunScript | Nuix | Run an arbitrary ruby script in nuix. It should return a string. |
NuixSearchAndExclude | Nuix | Run a search query in Nuix and exclude all items found. |
NuixSearchAndTag | Nuix | Searches a NUIX case with a particular search string and tags all files it finds. |
OpenConnection | Sql | Open a new connection to a database. |
Or | Core | Returns true if any terms are true |
PathCombine | FileSystem | Combine Paths. If the resulting path is not fully qualified it will be prefixed with the current working directory. |
Power | Core | Raises an integer to the power of a list of integers sequentially |
Print | Core | Prints a value to the console. |
Product | Core | Calculate the product of a list of integers |
PwshRunScript | Pwsh | Executes a powershell script. |
PwshRunScriptAsync | Pwsh | Executes a powershell script and returns any results written to the pipeline as an entity stream. Running a script asynchronously allows for input streaming. Note that the script only runs when the output of this Step is read. |
RelativityCreateDynamicObjects | Relativity | Create a relativity dynamic objects from entities. Returns an array of the new artifact ids |
RelativityCreateField | Relativity | Creates a new Fixed Length Field and returns the ArtifactId of that field |
RelativityCreateFolder | Relativity | Create a folder in a relativity workspace |
RelativityCreateKeywordSearch | Relativity | Creates a keyword search. Returns the artifact id of the created search. |
RelativityCreateMatter | Relativity | |
RelativityCreateWorkspace | Relativity | Creates a new Relativity Workspace |
RelativityDeleteDocument | Relativity | |
RelativityDeleteKeywordSearch | Relativity | |
RelativityDeleteMatter | Relativity | Delete a matter |
RelativityDeleteUnusedFolders | Relativity | Deletes unused folders in a relativity workspace |
RelativityDeleteWorkspace | Relativity | Deletes a relativity workspace |
RelativityExport | Relativity | |
RelativityGetClients | Relativity | Retrieve a list of the available clients that you can associate with a matter. |
RelativityGetMatterStatuses | Relativity | |
RelativityGetSubfolders | Relativity | Gets all children of a folder |
RelativityImport | Relativity | Imports a load file into Relativity using the desktop client |
RelativityImportEntities | Relativity | Import Entities into Relativity |
RelativityMoveFolder | Relativity | Move a folder and its children, including subfolders and documents. |
RelativityReadKeywordSearch | Relativity | Reads a search |
RelativityRetrieveMatter | Relativity | |
RelativityRetrieveRootFolder | Relativity | Retrieve the root folder of a Workspace |
RelativityRetrieveWorkspace | Relativity | |
RelativityRetrieveWorkspaceStatistics | Relativity | |
RelativitySendQuery | Relativity | Query for Workspaces, Documents, RDOs and System Types |
RelativityUpdateFolder | Relativity | Update a Relativity folder |
RelativityUpdateMatter | Relativity | |
RelativityUpdateObject | Relativity | Update a Relativity Object |
Repeat | Core | Repeat a step a set number of times. |
RESTDelete | Rest | Delete a REST resource |
RESTGetJSON | Rest | Get JSON from a REST service |
RESTGetStream | Rest | Get data from a REST service |
RESTPatch | Rest | Executes a REST Patch request |
RESTPost | Rest | Create a REST resource and return the id of the created resource |
RESTPut | Rest | Executes a REST Put request |
Round | Core | Round an SCL double to a fixed number of decimal places |
RunExternalProcess | Core | Runs an external executable program. |
RunSCL | Core | Runs SCL defined in a StringStream |
RunStep | Core | Runs another step, reads the output to the end, and ignores it. |
SchemaCreate | Core | Create a new schema by analysing the entity properties and values in an array or an entity stream. This Step is best used with data sources where the property values already have a data type (string, date, int...) such as JSON or databases. For generating schemas from flat data sources such as Concordance or CSV, use the SchemaCreateCoerced step, which will attempt to infer the property types. |
SchemaCreateCoerced | Core | Create a new schema by analysing the entity properties and values in an array or an entity stream. This Step is best used with flat data sources such as Concordance or CSV as it does additional processing to infer the data types of strings. |
Sequence | Core | A chain of steps to be run one after the other. |
SetVariable | Core | Sets the value of a named variable. |
SqlCommand | Sql | Executes a Sql command |
SqlCreateSchemaFromTable | Sql | Creates a Schema entity from a SQL table |
SqlCreateTable | Sql | Create a SQL table from a given schema |
SqlInsert | Sql | Inserts data into a SQL table |
SqlQuery | Sql | Executes a SQL query and returns the result as an entity stream. |
StandardErrorWrite | Core | Writes to the console standard error |
StandardInRead | Core | Reads the Console standard input |
StandardOutWrite | Core | Writes to the console standard output |
StringAppend | Core | Appends a string to an existing string variable. |
StringContains | Core | Returns true if the String contains the substring. |
StringFind | Core | Gets the index of the first instance of a substring in a string. The index starts at 0. Returns -1 if the substring is not present. |
StringFindLast | Core | Gets the last instance of substring in a string. The index starts at 0. Returns -1 if the substring is not present |
StringInterpolate | Core | Joins strings. Supports string interpolation. To use string interpolation, the string must be enclosed in double quotes and prefixed with a dollar-sign ($). Then, anything in curly brackets { and } will be evaluated as SCL. |
StringIsEmpty | Core | Returns whether a string is empty. |
StringJoin | Core | Join strings with a delimiter. |
StringLength | Core | Calculates the length of the string. |
StringMatch | Core | Returns true if a string is matched by a particular regular expression |
StringReplace | Core | Replace every regex match in the string with the result of a particular function |
StringSplit | Core | Splits a string. |
StringSubstring | Core | Gets a substring from a string. |
StringToBool | Core | Converts a string to a boolean |
StringToCase | Core | Converts a string to a particular case. |
StringToDate | Core | Converts a date to the specified format, yyyyMMddHHmm by default. If no date is specified, returns the current time. |
StringToDouble | Core | Converts a string to a double |
StringToInt | Core | Converts a string to an integer |
StringTrim | Core | Trims a string, removing whitespace from the TrimSide . |
Subtract | Core | Subtract a list of numbers from a number |
Sum | Core | Calculate the sum of a list of integers |
TesseractOCR | Tesseract | Returns true if the file in the specified path exists, false otherwise |
ToConcordance | StructuredData | Write entities to a stream in concordance format. The same as ToCSV but with different default values. |
ToCSV | StructuredData | Write entities to a stream in CSV format. The same as ToConcordance but with different default values. |
ToIDX | StructuredData | Write an entity to a stream in IDX format. |
ToJson | StructuredData | Writes an entity to a stream in JSON format |
ToJsonArray | StructuredData | Write entities to a stream in Json format. |
ToXml | StructuredData | Writes an entity to a stream in XML format |
ToXmlArray | StructuredData | Write entities to a stream in Xml format. |
ToYaml | StructuredData | Writes an entity to a stream in YAML format |
Transform | Core | Attempts to transform entities in the stream so that they match the schema. Will transform strings into ints, datetimes, booleans, array, or nulls where appropriate. The properties of the transformed entities will be in the same order as in the schema For more information on schemas please see the documentation. |
Try | Core | Tries to execute a step and recovers if that step results in failure. |
Validate | Core | Validate that the schema is valid for all entities. Does not evaluate the entity stream. For more information on schemas please see the documentation. |
While | Core | Repeat an action while the condition is met. |