If no data matches any filter conditions, what is the next block run by the playbook?

In a Splunk SOAR playbook, if no data matches the conditions specified within a filter block, the

playbook execution will proceed to the next block that is configured to follow the filter block. The

"next block" refers to whatever action or decision block is designed to be next in the sequence

according to the playbook’s logic.

Filters in Splunk SOAR are used to make decisions based on data conditions, and they control the

flow of the playbook. If the conditions in a filter block are not met, the playbook does not simply end

or restart; rather, it continues to execute the subsequent blocks that have been set up to handle

situations where the filter conditions are not met.

A filter block will typically have different paths for different outcomes—matching and non-matching.

If the conditions are matched, one set of blocks will execute, and if not, another set of blocks, which

could simply be the next one in the sequence, will execute. This allows for complex logic and

branching within the playbook to handle a wide range of scenarios.

In a Splunk SOAR playbook, when no data matches any filter conditions, the playbook continues to

run by proceeding to the next block in the sequence. The filter block is designed to specify a subset

of artifacts before further processing, and only artifacts matching the specified condition are passed

along to downstream blocks for processing1. If no artifacts meet the conditions, the playbook does

not end or restart; instead, it moves on to the next block, which could be any type of block

depending on the playbook’s design1.

Reference:

Use filters in your Splunk SOAR (Cloud) playbook to specify a subset of artifacts before further

processing - Splunk Documentation