When you're building workflows that process arrays or objects, you often need to apply the same logic repeatedly to multiple items. Maybe you're enriching security alerts, calculating risk scores, or transforming API responses. Instead of writing the same formula over and over, Tines gives you two powerful functions: LAMBDA and MAP_LAMBDA.
What LAMBDA does
LAMBDA creates a custom function that you can reuse. You define the parameters your function needs and the calculation it should perform. Think of it like writing a recipe: you list the ingredients (parameters) and the steps (calculation), then you can use that recipe whenever you need it.
❗️Important
LAMBDA basic syntax
LAMBDA takes one or more parameters, followed by the calculation you want to perform. The calculation is always the last argument.
LAMBDA([parameter1, parameter2, ...], calculation)LAMBDA example: Calculate risk score
Let's say you need to calculate a risk score based on severity and confidence throughout your workflow:
LAMBDA(severity, confidence, severity * confidence / 100)This creates a function that takes two parameters and returns a calculated risk score. You can now use this with MAP_LAMBDA, for example, to apply it to an entire array of alerts.
What MAP_LAMBDA does
MAP_LAMBDA takes your LAMBDA function and applies it to every item in an array or every key-value pair in an object. It returns a new array with the transformed results. Think of it like an assembly line: You define what should happen to each item (the LAMBDA), then MAP_LAMBDA runs every item through that process and gives you back the transformed collection.
MAP_LAMBDA basic syntax
MAP_LAMBDA takes an array or object and a LAMBDA function. It applies the LAMBDA to each element and returns the results.
MAP_LAMBDA(array_or_object, lambda)MAP_LAMBDA example: Add priority field to alerts
Let's say you have an array of security alerts and you need to add a priority field to each one:
MAP_LAMBDA(
get_alerts.body.alerts,
LAMBDA(alert,
MERGE(
alert,
OBJECT("priority", IF(alert.severity >= 8, "Critical", IF(alert.severity >= 5, "High", "Medium")))
)
)
)This takes each alert, keeps all its original fields, and adds a new "priority" field based on the severity value. We'll walk through this example in the emulation below.