In the default data ingestion that we provide, the following query is
used to fetch the events: SELECT {<!-- -->{vars.event_query_params}} FROM EVENTS
WHERE INOFFENSE({<!-- -->{vars.alertSourceData.offense_data['id']}}) ORDER BY
starttime DESC LIMIT {<!-- -->{vars.event_rec<!-- --><!-- -->...
I think we need to add a new checkbox parameter 'Fetch All Records' in
the action, which will return all records, so the logic of fetching all
records can be written in backend code instead of trying to implement it
in playbook.
You can set variables in a playbook step, use those variables in next
steps and then after that you can use decision step to go back to any
previous step based on the condition that you define.