Loop continue

The loop.continue step skips the rest of the current iteration in the innermost enclosing foreach or while loop and moves on to the next iteration. Use it to skip items that don't meet a filter, without nesting the remaining logic inside an if.

Schema convention. In each schema table on this page, the Location column indicates where each parameter sits in the YAML:

top level: Alongside type and name, at the top of the step or trigger definition.
`with`: Inside the step's with: block.
`on`: Inside the trigger's on: block.

Parameters

loop.continue takes no parameters.

Parameter	Location	Type	Required	Description
`name`	top level	string	Yes	Unique step identifier.
`type`	top level	string	Yes	Must be `loop.continue`.

Example: Skip benign alerts

- name: process_alerts
  type: foreach
  foreach: "${{ event.alerts }}"
  steps:
    - name: filter_benign
      type: if
      condition: "foreach.item.kibana.alert.severity : low"
      steps:
        - name: next
          type: loop.continue

    - name: enrich
      type: virustotal.scanFileHash
      connector-id: "my-virustotal"
      with:
        hash: "{{ foreach.item.file.hash.sha256 }}"

    - name: record
      type: cases.addComment
      with:
        case_id: "{{ consts.case_id }}"
        comment: "Enriched: {{ foreach.item._id }} — {{ steps.enrich.output.stats.malicious }} hits"

Low-severity alerts are skipped; the loop moves on to the next alert without running enrich or record.

Flow control steps: Overview of all flow-control types.
Loop break step: Exit the loop entirely instead of skipping to the next iteration.
Foreach step and While step: The loop types loop.continue can act on.