Transform Data Action - Use Cases

The Turbine Transform Data native action can create a myriad of transformations. Making changes to date and time in a playbook is often used, and this page provides use cases for different actions for transforming date and time using the Transform Data action. JSONata is used for these actions.

If you configure the FIRST row, click TRANSFORM AGAIN, and select Get Date/Time, there are new configuration options available.

Note: When FROM is set to "Current Time", the IN field is not required and will be hidden.

After identifying malicious URLs, you want to scan your environment for any other IOCs that may have been seen 90 days before the first sighting. With the Transform Data action, you can automate this task to get a date/time and subtract 90 days.

Common date and time data transformation methods are supported in playbooks, which can be run against playbook inputs, in-scope action output properties, or static values, including to and from:

Note: Adjust Date/Time operates on ISO-8601 date/time values or Unix epochs. The result is always returned in ISO-8601 format.

After identifying malicious URLs, you want to scan your environment for any other IOCs that may have been seen 90 days before the first sighting. With the Transform Data action, you can automate this task to get a date/time and subtract 90 days.

Output: The date/time adjusted by subtracting 90 days, returned in ISO-8601 format.

After configuring the FIRST row, click TRANSFORM AGAIN, and select Set Time Zone. New fields and options are available on the THEN row.

Note: Set Time Zone adjusts the underlying date/time to reflect the new timezone. If you need to add timezone information without changing the actual time, use Append Time Zone instead.

After identifying malicious URLs, you want to scan your environment for any other IOCs that may be in a specific time zone.

Output: The date/time converted to the specified time zone in ISO-8601 format.

After configuring the FIRST row, click TRANSFORM AGAIN, and select Convert Date/Time. New fields and options are available on the THEN row.

Note: Convert Date/Time can convert between various date/time formats. The input date/time must be in ISO-8601 format or a Unix epoch.

After identifying malicious URLs, you want to scan your environment for any other IOCs that may have been seen starting on a particular month, date, and year before the first sighting.

Output: The date/time converted to the custom format (e.g., "08/26/2025").

The Contains transformation checks if a string contains at least one occurrence of a search term. The transformation options are:

After gathering information from different sources, you want to verify if a particular keyword (e.g., "malicious") is present in a text field.

Output: Returns true if "malicious" is found in the text (regardless of case), false otherwise.

The Replace transformation finds occurrences of a search term in a string and replaces each occurrence with another string. The transformation options are:

You need to normalize IP addresses in logs by replacing occurrences of "192.168" with "10.0".

Output: All occurrences of "192.168" (case-insensitive) are replaced with "10.0" in the input string.

The Match transformation finds occurrences of a search term in a string and returns an array of all indices where the search term is located. The transformation options are:

To locate specific email addresses from text logs, match the pattern of an email address format.

Note: For regex pattern matching to extract email addresses, use the Regex Match transformation instead, which supports regular expression patterns.

Output: Returns an array of indices where the search term appears in the string (e.g., [25, 67, 142]).

The From CSV transformation parses a CSV string into an array of objects (if headers are included) or an array of arrays. The transformation options are:

You have a CSV string containing user information ("name, email, department") and want to parse it into separate fields.

Example Input (with headers):

Output (with headers = Yes):

Output (with headers = No):

When working with JSON data from record triggers, record searches, or HTTP responses, the data often arrives as a string. Use Parse JSON to convert it to a JavaScript object before extracting properties.

Scenario: Extract user information from a JSON string returned by an API.

Use Filter or Filter By to extract specific items from arrays based on criteria.

Scenario: Filter an array of users to include only those with a specific status.

Output: An array containing only objects where the specified property matches the filter value.

Use Prepend to combine arrays or prepend values to arrays.

Scenario: Combine two arrays of IOCs into a single array.

Output: A new array containing the prepended values followed by the original values.

For more information on available transformations, see Using the Transform Data Native Action.

For advanced transformation capabilities using JSONata expressions, see Advanced Transformations.