### Create Cortex XSIAM scripts
Creating custom scripts in Cortex XSIAM helps meet your organization’s specific needs to automate repetitive tasks, streamline security operations, and make case response more efficient.
1. Navigate to **Investigation & Response** → **Automation** → **Scripts** and click **New Script**.
2. Add an identifying name for the script.
3. Click **Save**.
4. In the **Agentic Assistant** pane, start a conversation with the Automation Engineer agent to create the script, or manually create the script code and define the script settings.
For more information, see [Automation Engineer for scripts](accelerate-script-development-using-the-automation-engineer-agent). For details about script settings, see script settings below.
5. Save the script version.
6. (Recommended) Click **Test** to validate your script.
1. In the **Arguments** section, provide values for any inputs your prompt requires. These inputs are used to simulate how the script will behave in a live playbook, or how the script registered as an Action and assigned to an Agent will run as part of an executed plan.
You can add input values manually.
2. Click **Run**.
The tests are executed in a Playground environment. Review the output generated by the AI to validate the script's behavior and ensure it produces the expected results. The output is typically a text summary or another structured format that you have defined.
<div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>If there is an error, you can copy the error message from the test result into the Agentic Assistant prompt and ask the Automation Engineer agent to correct the error.</p></div>
In each run result, you can take the following actions:
| Action | Description |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Mark as note | <p>Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions.</p><p>When marked as a note, it is highlighted, so you can easily find it in the War Room or the <strong>Issue Overview</strong> tab.</p> |
| View artifact in new tab | Opens a new tab for the artifact. |
| Download artifact | Downloads the run details to a text file, including the AI task name,, the script name, user name and password, and the result. |
| Add tags | Add any relevant tags to use that help you find relevant information. |
7. (Optional) Click <img src="/docs/images/cd7babf41b26ba87.png" alt="three-dots-dark.png" data-size="line"> and select **Register new Action** to register the script as an Action. For more information, see Manage actions.
* You can enable/disable a script in the Settings without having to duplicate the script.
* You can view recently modified or deleted scripts by clicking the version history for all scripts <img src="/docs/images/5fc95f10416e01cd.png" alt="versionhistory.png" data-size="line">.
### Configure Cortex XSIAM script settings
### Basic script settings
Define the relevant Basic script parameters.
**Important**
Role-Based access: Your ability to configure or test scripts that use stored credentials depends on your role's **Credentials** permission. If set to **None**, you cannot reference pre-saved secrets during configuration or testing. For more information, see [Credentials permissions](../../../reference-and-developer-docs/role-based-access-control/configuration-permissions/credentials-permissions).
| Parameter | Description |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Name | An identifying name for the script. |
| Language type | <p>Select the script language type.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Important</strong></p><p>If you choose Python, from the <strong>Agentic Assistant</strong> you can use the Automation Engineer agent.</p></div> |
| Description | A meaningful description of the script. |
| Tags | <p>Predefined script identifiers.</p><p>For example, if a script is intended for phishing, tagging it with the phishing tag helps organize, classify, and manage the script among other scripts.</p><p>Organizations can also implement policies or restrictions based on tags associated with scripts. For example, they may restrict certain users from accessing or executing a script tagged for phishing.</p> |
| Enabled | Whether the script is available for playbook tasks and indicator types, or to run in the CLI. |
### Arguments
You can create, edit, or delete arguments as required.
| Parameter | Description |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Argument | An identifying name. |
| Mandatory | Makes the argument mandatory. |
| Default | Makes the argument the default. |
| Sensitive | <p>Hides the argument from being displayed in the UI and in logs.</p><ul><li><strong>Authentication (Type 9) Arguments</strong>: For scripts that use credential-type arguments, users with the <strong>Credentials</strong> permission set to <strong>None</strong> will see the message <strong>Credentials are locked by admin</strong> and will be unable to select pre-saved secrets from the UI dropdown. For more information, see <a href="../../../reference-and-developer-docs/role-based-access-control/configuration-permissions/credentials-permissions">Credentials permissions</a>.</li></ul> |
| Description | A meaningful description of the argument. |
| Default | The default value for the argument. |
| Is array | Specifies that the argument is an array. |
| List options | A comma-separated list of argument values. |
You can create, edit, or delete outputs as required. Define the outputs according to types such as string, number, date, and Boolean. For more information, see [Context and Outputs](https://xsoar.pan.dev/docs/integrations/context-and-outputs).
| Parameter | Description |
| ------------ | ------------------------------------------------------------------------------------------------------------------------ |
| Context Path | A dot-notation representation of the path to access the Context. For example, **`ThreatStream.Analysis.ReportID`**. |
| Description | A short description of what the context path represents. For example, the ID of the report submitted to the sandbox. |
| Type | The value type of the context path, such as string, number, and date, enables Cortex XSIAM to format the data correctly. |
### Script permissions
| Parameter | Description |
| ---------------- | ---------------------------------------------------------------------------------------------------------- |
| Password Protect | Enables you to add a password for the script, which will be required when running the script from the CLI. |
### Advanced
| Parameter | Description |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Timeout (seconds) | Time (in seconds) before the script times out. Default is 180. |
| Docker image name | <p>For Python scripts, this is the name of the Docker image to use for the script.</p><p>Cortex XSIAM supports the following Python versions:</p><ul><li>2.7</li><li>3.0 and later</li></ul><p>You can change the Docker image.</p><p>The default Docker image that Cortex XSIAM uses is <code>demisto/python3</code>, but you can use other Docker images.</p> |
| Run on a separate container | Runs the script on a separate container. |
### Depends on commands
You can set the commands that the script depends on directly from these settings. You still have the option to set the dependencies in the script YAML file.
### Edit Cortex XSIAM script code
### Edit existing code or create new code
Modify parameters, logic, or integrations within a script to adapt it to specific use cases, optimize performance, and address evolving security needs without starting from scratch.
The [Script Helper](https://xsoar.pan.dev/docs/concepts/xsoar-ide#the-script-helper) provides a list of available alphabetically ordered commands and scripts.