Common Scripts (v1.22.52)
Frequently used scripts pack.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Utilities
Incident fields (52)
- Account information breached
- Affected Data Type
- Affected Individuals Contact Information
- Affected data
- Approximate number of affected data subjects
- Attorney General Notification
- Breach Confirmation
- Company Address
- Company City
- Company Country
- Company Name
- Company Postal Code
- Company has Insurance for the Breach
- Consumer Reporting Agencies Notification
- Contact Address
- Contact Email address
- Contact Name
- Contact Telephone number
- Country where business has its main establishment
- Country where the breach took place
- DPO E-mail Address
- DPO Notification
- Data Encryption Status
- Date/time of the breach
- E-mail Address
- Financial information breached
- GDPR Notify Authorities
- Health insurance breached
- Individuals Notification
- Is the Data Subject to DPIA
- Likely Impact
- Malicious Cause (If the cause is a malicious attack)
- Management Notification
- Measures to Mitigate
- Media Notification
- Medical Information breached
- Other PII data breached
- PII Data Type
- Possible Cause of the Breach
- Postal Code
- Resident Notification Option
- Residents Email Address
- Secretary Notification
- Sector of Affected Party
- Size - number of employees
- Size - turnover
- State CISO Notification
- State where the breach took place
- Telephone no.
- Unique biometric data breached
- Unique identification number breached
- Where is data hosted
Lists (2)
- InternalDomains
- PrivateIPs
Scripts (291)
- AddDBotScoreToContext
- AddEvidence
- AddKeyToList
- AnalyzeTimestampIntervals
- AppendindicatorFieldWrapper
- AquatoneDiscoverV2
- AreValuesEqual
- ArrayToCSV
- AssignAnalystToIncident
- AssignToMeButton
- BMCTool
- Base64Encode
- Base64EncodeV2
- Base64ListToFile
- BreachConfirmationHTML
- CEFParser
- CVSSCalculator
- CalculateEntropy
- CalculateTimeDifference
- CertificateExtract
- CertificateReputation
- ChangeContext
- ChangeRemediationSLAOnSevChange
- CheckContextValue
- CheckFieldValue
- CheckIndicatorValue
- CheckPDFEncryptionAndValidity
- CheckSenderDomainDistance
- CloseInvestigationAsDuplicate
- CompareIncidentsLabels
- CompareLists
- ContainsCreditCardInfo
- ContentPackInstaller
- ContextContains
- ContextFilter
- ContextGetEmails
- ContextGetHashes
- ContextGetIps
- ContextGetPathForString
- ContextSearchForString
- ConvertCountryCodeCountryName
- ConvertDatetoUTC
- ConvertFile
- ConvertTableToHTML
- ConvertTimezoneFromUTC
- ConvertXmlFileToJson
- ConvertXmlToJson
- CopyContextToField
- CopyNotesToIncident
- CountArraySize
- CreateArray
- CreateEmailHtmlBody
- CreateHash
- CreateIndicatorsFromSTIX
- CreateNewIndicatorsOnly
- DBotAverageScore
- DBotClosedIncidentsPercentage
- DecodeMimeHeader
- DeduplicateValuesbyKey
- DeleteContext
- DemistoVersion
- Dig
- DisableUserWrapper
- DisplayHTML
- DisplayHTMLWithImages
- DockerHardeningCheck
- DomainReputation
- DownloadAndArchivePythonLibrary
- DumpJSON
- EditServerConfig
- EmailAskUser
- EmailAskUserResponse
- EmailDomainSquattingReputation
- EmailReputation
- EncodeToAscii
- EvaluateContextValue
- ExampleJSScript
- ExecuteCommandAt
- ExifRead
- Exists
- ExportAuditLogsToFile
- ExportContextToJSONFile
- ExportIncidentsToCSV
- ExportIndicatorsToCSV
- ExportToCSV
- ExportToXLSX
- ExposeIncidentOwner
- ExtractAttackPattern
- ExtractDomainAndFQDNFromUrlAndEmail
- ExtractDomainFromUrlAndEmail
- ExtractEmailV2
- ExtractFQDNFromUrlAndEmail
- ExtractHTMLTables
- ExtractHyperlinksFromOfficeFiles
- ExtractIndicatorsFromTextFile
- ExtractIndicatorsFromWordFile
- FailedInstances
- FeedRelatedIndicatorsWidget
- FetchIndicatorsFromFile
- FileCreateAndUpload
- FileCreateAndUploadV2
- FileReputation
- FileToBase64List
- FilterByList
- FindSimilarIncidents
- FormatURL
- GenerateAsBuilt
- GenerateAsBuiltConfiguration
- GenerateInvestigationSummaryReport
- GeneratePassword
- GenerateRandomString
- GenerateRandomUUID
- GenerateSummaryReportButton
- GenerateSummaryReports
- GenericPollingScheduledTask
- GetByIncidentId
- GetCaseExtraData
- GetDataCollectionLink
- GetDockerImageLatestTag
- GetDomainDNSDetails
- GetDuplicatesMlv2
- GetEnabledInstances
- GetEntries
- GetErrorsFromEntry
- GetFieldsByIncidentType
- GetIndicatorDBotScore
- GetIndicatorDBotScoreFromCache
- GetInstances
- GetLicenseID
- GetListRow
- GetServerURL
- GetStringsDistance
- GetTime
- GridFieldSetup
- HTMLtoMD
- HTTPListRedirects
- HttpV2
- IPNetwork
- IPReputation
- IPToHost
- IdentifyAttachedEmail
- IncidentAddSystem
- IncidentFields
- IncreaseIncidentSeverity
- IndicatorMaliciousRatioCalculation
- IsDomainInternal
- IsEmailAddressInternal
- IsGreaterThan
- IsIPInRanges
- IsIPPrivate
- IsIntegrationAvailable
- IsInternalDomainName
- IsInternalHostName
- IsListExist
- IsMaliciousIndicatorFound
- IsPDFFileEncrypted
- IsTrue
- IsUrlPartOfDomain
- IsValueInArray
- IsolationAssetWrapper
- JSONDiff
- JSONFileToCSV
- JSONtoCSV
- JsonUnescape
- LanguageDetect
- LessThanPercentage
- LinkIncidentsButton
- LinkIncidentsWithRetry
- ListUsedDockerImages
- LoadJSON
- LoadJSONFileToContext
- LookupCSV
- MITRENameByID_Formatter
- MaliciousRatioReputation
- MapValues
- MarkAsEvidenceByTag
- MarkAsNoteByTag
- MarkRelatedIncidents
- MatchRegex
- MatchRegexV2
- MathUtil
- NotInContextVerification
- NumberOfPhishingAttemptPerUser
- OnionURLReputation
- PDFUnlocker
- PFXAnalyzer
- ParseCSV
- ParseEmailFiles
- ParseEmailFilesV2
- ParseExcel
- ParseHTMLIndicators
- ParseWordDoc
- ParseYAML
- PcapHTTPExtractor
- Ping
- PopulateCriticalAssets
- PortListenCheck
- PositiveDetectionsVSDetectionEngines
- PreProcessImage
- PrettyPrint
- PrintContext
- PrintErrorEntry
- PrintRaw
- PrintToAlert
- PrintToIncident
- PrintToParentIncident
- ProvidesCommand
- PublishEntriesToContext
- ReadFile
- ReadPDFFileV2
- ReadQRCode
- RemoteExec
- RemoveKeyFromList
- ReplaceMatchGroup
- RepopulateFiles
- ResolveShortenedURL
- RunDockerCommand
- RunPollingCommand
- SCPPullFiles
- SSDeepReputation
- SSDeepSimilarity
- ScheduleCommand
- ScheduleGenericPolling
- SearchCases
- SearchIncidentsSummary
- SearchIncidentsV2
- SearchIndicator
- SearchIndicatorAgentix
- SearchIssuesAgentix
- SendEmailOnSLABreach
- SendMessageToOnlineUsers
- SendNotificationAgentix
- ServerLogs
- ServerLogs_docker
- Set
- SetAndHandleEmpty
- SetByIncidentId
- SetDateField
- SetGridField
- SetIndicatorAgentix
- SetIndicatorGridField
- SetMultipleValues
- SetTime
- SetWithTemplate
- ShowIncidentIndicators
- ShowLocationOnMap
- ShowOnMap
- ShowScheduledEntries
- Sleep
- StixCreator
- StopScheduledTask
- StopTimeToAssignOnOwnerChange
- StringLength
- StringReplace
- StringSimilarity
- Strings
- TextFromHTML
- TimeStampCompare
- ToTable
- TopMaliciousRatioIndicators
- URLNumberOfAds
- URLReputation
- URLSSLVerification
- UnEscapeIPs
- UnEscapeURLs
- UnPackFile
- UnzipFile
- UtilAnyResults
- VerdictResult
- VerifyCIDR
- VerifyIPv6Indicator
- VerifyJSON
- VerifyValidIP
- WordTokenizer
- ZipFile
- ZipStrings
- checkValue
- commentsToContext
- cveReputationV2
- cvss_color
- displayMappedFields
- displayUtilitiesResults
- emailFieldTriggered
- enrich_exclude_button
- findIncidentsWithIndicator
- hideFieldsOnNewIncident
- http
- isError
- listExecutedCommands
- ticksToTime