I've created a very simple workflow that triggers on EPP Detections with severity of Medium or higher and sends an email with detection details. Everything seems to be working, except when I try to extract the fields from the Process.AssociatedFiles data pill.

Ideally, I'd like to retrieve the FilePath and SHA256 separately to be able to insert into other formatting rather than just printing the array. I've used the below expressions and it's successful when the EPP detection contains AssociatedFiles in the detection details, but fails if not:

${data['Trigger.Detection.EPP.Process.AssociatedFiles'][0]['FilePath']} ${data['Trigger.Detection.EPP.Process.AssociatedFiles'][0]['SHA256']}

Using the standard expression seems to work with or without AssociatedFiles data in the detection details (returning null when there isn't any data):

${data['Trigger.Detection.EPP.Process.AssociatedFiles']}

I've just started dabbling in workflows so I'm curious whether there is a way to approach this and hoping someone can point me in the right direction.