A1000FinalClassification [ReversingLabs_A1000] — Calculates A1000 final classification based on A1000 classification and A1000 full reports.
ATDDetonate [McAfee_Advanced_Threat_Defense] — Detonate File or URL through McAfee ATD.
AWSAccountHierarchy [AWS-Enrichment-Remediation] — Determine AWS account hierarchy by looking up parent objects until the organization level is reached.
AWSApiModule [ApiModules] — AWS Client class, provides generic Infrastructure to all AWS integrations.
AWSIdentifySGPublicExposure [CloudSecurityPolicyManagement] — Automation to determine which interface on an EC2 instance has a given public IP and identify associated security groups.
AWSPackageUpgrade [AWS_SystemManager] — This is an AWS script that upgrades a package on the AWS EC2 instance using AWS Systems manager.
AWSRecreateSG [AWS-Enrichment-Remediation] — Automation to determine which interface on an EC2 instance has an over-permissive security group, determine which security groups have over-permissive rules, and replace them with a copy of the security group that has only the over-permissive portion removed. Over-permissive is defined as sensitive ports (SSH, RDP, etc) being exposed to the internet via IPv4.
AWSRemediateSG [CloudSecurityPolicyManagement] — Duplicates security groups and modifies rules to remove public exposure for the specified port. The updated security groups can then be used to remediate public exposure of an AWS resource by replacing the existing list.
AbuseIPDBPopulateIndicators [AbuseDB] — Extracts IP addresses on block lists from AbuseIPDB, and Populates Indicators accordingly.
AddEvidence [CommonScripts] — Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)
AddKeyToList [CommonScripts] — Adds/Replaces a key in key/value store backed by an XSOAR list.
AddUserToIncidentTeam [CaseManagement-Generic] — Adds an XSOAR User to the Incident, this automation can be used as part of a playbook task.
AdoptionMetrics [CommonDashboards] — The dashboard provide a high level overview on the usage of Cortex XSOAR. It contains data points and metrics on enriched and observed threat intelligence, playbook and automation executions, and data sources being ingested into Cortex XSOAR.
AfterRelativeDate [FiltersAndTransformers] — Checks the given datetime has occured after the provided relative time.
AggregatedCommandApiModule [ApiModules] — Common Aggregated Command API Module, provides generic Infrastructure for different kinds of aggregated commands.
AlgosecGetTicket [Algosec] — Retrieves a FireFlow change request by its ID
AlgosecQuery [Algosec] — Performs a batch traffic simulation query using Firewall Analyzer.
AnalyzeMemImage [Volatility] — Use Volatility to run common memory image analysis commands
AnalyzeOSX [OSXCollector] — Get file and url reputation for osxcollector result.
will use VirusTotal for Url checks, and IBM XForce for MD5 checks.
maxchecks : for
system : system name to run agent on.
section : the type check that OSXCollector should run.
AnalyzeTimestampIntervals [CommonScripts] — Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps.
AnsibleApiModule [ApiModules] — Common Ansible code that will be appended to each Ansible integration.
AnthropicClaudeApiModule [ApiModules] — Provides common Anthropic Claude Compliance API code shared by the AnthropicClaude and AnthropicClaudeStandardConnector integrations.
AnyLlmAddResultsConvo [AnythingLLM] — Takes search results and adds them to the LLM conversation context. Adding these results to the context is done invisibly in XSOAR, but is present in the LLM and will display in the conversation when the workspace is re-entered.
AnyLlmClearConvo [AnythingLLM] — Clears the current workspace conversation buffer stored in an XSOAR field and deletes the LLM's workspace conversation thread. The next question starts a new conversation thread with empty LLM context.
AnyLlmDocuments [AnythingLLM] — Queries the LLM for the list of documents that have been uploaded and copies it into an XSOAR grid field for display and additional actions.
AnyLlmDocumentsUpdate [AnythingLLM] — When an action is requested in the documents grid field, executes the requested action (Embed or Delete) on a document in the LLM. "Delete" removes the document from the LLM's document catalog, and "Embed" adds the vector embedding of the document to the current workspace.
AnyLlmQuestion [AnythingLLM] — Sends a message to the LLM. If any search results have been added to the conversation, they are added to the LLM workspace thread's context just before the latest message is added. The pending search results buffer is then cleared.
AnyLlmSaveConvo [AnythingLLM] — Saves the current conversation as a war room entry.
AnyLlmSearchDocument [AnythingLLM] — Full text search of a LLM document for a text pattern (regex) for more results as a companion to similarity search that returns a few top results. Currently supports only war room file entries, search results, and text that has been preprocessed in XSOAR prior to uploading to the LLM. (See AnyLlmUploadText, AnyLlmUploadFileEntry and AnyLlmUploadDocument). Results are placed in the search results buffer for where they can be added to the LLM's conversation context.
AnyLlmSearchXsoarContext [AnythingLLM] — Search incident context keys for text results. Results are placed in the search results buffer for where they can be added to the LLM's conversation context.
AnyLlmSearchXsoarEntries [AnythingLLM] — Search war room entries for text results. Results are placed in the search results buffer where they can be added to the LLM's conversation context.
AnyLlmSearchXsoarIncident [AnythingLLM] — Search incident fields for text results. Results are placed in the search results buffer where they can be added to the LLM's conversation context.
AnyLlmSearchXsoarIndicators [AnythingLLM] — Search indicators for text results. Results are placed in the search results buffer where they can be added to the LLM's conversation context.
AnyLlmUploadDocument [AnythingLLM] — Uploads pre-processed text data to the LLM's document catalog. The document data must have been prepared by AnyLlmUploadText, AnyLlmUploadFileEntry, AnyLlmUploadResults. Text documentation processed and uploaded by this method can also be full text searched.
AnyLlmUploadFileEntry [AnythingLLM] — Processes a war room file entry for uploading as an LLM document by AnyLlmUploadDocument so that a full text search can also be performed on the document after uploading.
AnyLlmUploadResults [AnythingLLM] — Processes search results for uploading as an LLM document by AnyLlmUploadDocument so that a full text search can also be performed on the document after uploading.
AnyLlmUploadText [AnythingLLM] — Processes text data for uploading as an LLM document by AnyLlmUploadDocument and so that a full text search can also be performed on the document after uploading.
AnyLlmUploadWebLink [AnythingLLM] — Uploads a web link as a LLM document. Does not currently support full text search.
AnyLlmWorkspaceEmbeddings [AnythingLLM] — List the current LLM workspace's embedded documents in an XSOAR grid field.
AnyLlmWorkspaceEmbeddingsUpdate [AnythingLLM] — Executes the actions taken on an embedded document in the grid field. "Pin" adds the entire document to the LLM's conversation context. Care should be taken not to pin very large documents that may impact the conversation's context negatively. "Unpin" removes the pinning of the document to the workspace. "Remove" removes the document's embedding from the workspace.
AnyLlmWorkspaceUpdate [AnythingLLM] — Executes the action taken on a workspace listed in the grid field. "Current" makes the workspace the active workspace and any workspace setting changes are updated in the LLM.
AnyLlmWorkspaces [AnythingLLM] — Queries the LLM for a list of workspaces and copies it into an XSOAR grid field were the user can select an active workspace.
AnyMatch [FiltersAndTransformers] — Returns all elements from the left side that have a substring that is equal to an element from the right side. Note: This filter is case-insensitive.
E.g -AnyMatch left=baby right=A will return baby. For more examples see the filter's Readme.
AppendIfNotEmpty [FiltersAndTransformers] — Append item(s) to the end of the list if they are not empty.
AppendindicatorFieldWrapper [CommonScripts] — A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators.
Note: You can use this script in an incident Layout button to allow tags to be added to indicators through the incident.
AquatoneDiscoverV2 [CommonScripts] — aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery.
ArcherCreateIncidentExample [ArcherRSA] — This script is an example script of how to create Incident in Archer. The script generates the create incident data in JSON format and execute the command archer-create-record.
AreValuesEqual [CommonScripts] — Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
ArrayAnyMatch [FiltersAndTransformers] — Returns true if an element is shared between two lists.
ArrayToCSV [CommonScripts] — Converts a simple Array into a textual comma separated string.
AsimilyExtraAssetContextData [Asimily_Insight] — Script for extracting Asimily device attributes from incident context data.
AssignAnalystToIncident [CommonScripts] — Assign analyst to incident.
By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users).
Otherwise, the analyst will be picked according to the 'assignBy' arguments.
machine-learning: DBot will calculated and decide who is the best analyst for the job.
top-user: The user that is most commonly owns this type of incident
less-busy-user: The less busy analyst will be picked to be the incident owner.
online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users).
current: The user that executed the command.
AssignAnalystToIncidentOOO [ShiftManagement] — Assigns analysts who are not out of the office to the shift handover incident.
Use the ManageOOOusers automation to add or remove analysts from the out-of-office list.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
For Cortex XSOAR 6 use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations and for Cortex XSOAR 8 Cloud use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script.
AssignToMeButton [CommonScripts] — Assigns the current Incident to the Cortex XSOAR user who clicked the button.
AssignToNextShift [ShiftManagement-AssignToNextShift] — Randomly assigns the incidents to users on call (requires shift management) and users on call.
See for more information: [Cortex XSOAR 6.13](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Shift-Management) [Cortex XSOAR 8 Cloud](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Manage-roles-in-the-Cortex-XSOAR-tenant) [Cortex XSOAR 8.7 On-prem](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Manage-roles-in-the-Cortex-XSOAR-tenant)
Incident IDs should be passed as a comma-separated list.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
AssignToNextShiftOOO [ShiftManagement] — Randomly assigns the active incidents to on call analysts (requires shift management).
This automation works with the other out-of-office automations to ensure only available analysts are assigned to the active incidents.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
For Cortex XSOAR 6 use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations and for Cortex XSOAR 8 Cloud use the link https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script.
AtlassianApiModule [ApiModules] — Common Atlassian OAuth code for Jira and Confluence integrations.
Autoruns [D2] — Deprecated. No available replacement.
AwsEC2GetPublicSGRules [AWS-EC2] — Find Security Group rules which allows ::/0 (IPv4) or 0.0.0.0/0.
AwsEC2SyncAccounts [AWS-EC2] — Update an AWS - EC2 instance with a list of accounts in an AWS organization, which will allow EC2 commands to run in all of them.
AzureFindAvailableNSGPriorities [Azure-Enrichment-Remediation] — This script takes in a list of numbers that represent Azure priorities for NSG rules, a target priority number, and a number available priorities to return available priorities from the provided list.
AzureIdentifyNSGExposureRule [CloudSecurityPolicyManagement] — Identifies the first inbound Allow rule in a specified NSG that matches network exposure criteria. Returns rule details and a list of available priority numbers for inserting higher-priority rules.
BMCHelixRemedyforceCreateIncident [BmcHelixRemedyForce] — This script is used to simplify the process of creating the incident in BMC Helix Remedyforce. The Script will consider the ID over the name of the argument when both are provided. Example: client_id is considered when both client_id and client_user_name are provided.
BMCHelixRemedyforceCreateServiceRequest [BmcHelixRemedyForce] — This script is used to simplify the process of creating a service request in BMC Helix Remedyforce. The script will consider the ID over the name of the argument when both are provided. Example: client_id is considered when both client_id and client_user_name are provided.
BMCTool [CommonScripts] — Parse RDP bitmap cache data into a single collage image file.
Base64Decode [FiltersAndTransformers] — Decodes an input in Base64 format.
Base64Encode [CommonScripts] — Will encode an input using Base64 format.
Base64EncodeV2 [CommonScripts] — Encodes an input to Base64 format.
Base64ListToFile [CommonScripts] — Converts Base64 file in a list to a binary file and upload to warroom.
BaseContentApiModule [ApiModules] — Base classes for building robust Cortex integrations with user-friendly validation, common connection settings, and centralized execution configuration.
BaseScript [StarterPack] — [Enter a description of the script, including what function it performs and any important information users need to know, for example required permissions.].
BatchData [CommunityCommonScripts] — This Automation takes in a string of comma separated items and returns a dictionary of with the defined chunk size.
BeforeRelativeDate [FiltersAndTransformers] — Checks the given datetime has occured before the provided relative time.
BetweenDates [FiltersAndTransformers] — Whether value is within a date range.
BetweenHours [FiltersAndTransformers] — Checks whether the given value is within the specified time (hour) range.
BrandImpersonationDetection [SlashNextPhishingIncidentResponse] — Analyzes the forensic data to detect brand impersonation attacks. This script uses the HMRC brand as an example, please modify the attributes associated with your company’s brand.
BuildEWSQuery [MicrosoftExchangeOnPremise] — Returns an EWS query according to the automation's arguments.
BuildSlackBlocksFromIndex [XSOARLabUpdates] — Extracts the index.zip and filters new packs since the last run.
Builds the slack message for new packs.
CBAlerts [Carbon_Black_Enterprise_Response] — Get the list of Alerts from Carbon Black Enterprise Response. Supports the same arguments as the cb-alerts command.
CBEvents [Carbon_Black_Enterprise_Response] — Returns all events associated with a process query
CBFindIP [Carbon_Black_Enterprise_Response] — Search Carbon Black for connection to specified IP addresses.
CBLiveFetchFiles [Carbon_Black_Enterprise_Response] — Deprecated. Use CBLiveGetFile_V2 instead. Live.
CBLiveGetFile [Carbon_Black_Enterprise_Response] — Deprecated. Use CBLiveGetFile_V2 instead. Use Carbon black Response Live session to retrieve a file from an endpoint. Endpoint needs to have a CbResponse sensor deployed.
CBLiveGetFile_V2 [Carbon_Black_Enterprise_Response] — This automation translates an endpoints hostname/IP to the Carbon Black sensor ID.
It then opens a session to the endpoint to download the given file paths and closes the session.
CBLiveProcessList [Carbon_Black_Enterprise_Live_Response] — Deprecated. No available replacement.
CBPApproveHash [CarbonBlackProtect] — Deprecated. Use the cbp-fileRule-createOrUpdate command instead.
CBPBanHash [CarbonBlackProtect] — Deprecated. Use the cbp-fileRule-createOrUpdate command instead.
CBPCatalogFindHash [CarbonBlackProtect] — Search the CBP/Bit9 file catalog for an md5 hash.
CBPFindComputer [CarbonBlackProtect] — Find a computer in CBEP/Bit9.
CBPFindRule [CarbonBlackProtect] — Find the rule state for a hash value in CBEP/Bit9.
CBSensors [Carbon_Black_Enterprise_Response] — List Carbon Black sensors
CBSessions [Carbon_Black_Enterprise_Response] — List Carbon Black sessions
CBWatchlists [Carbon_Black_Enterprise_Response] — Display all watchlists and their details, queries, etc.
CEFParser [CommonScripts] — Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields.
CIDRBiggerThanPrefix [FiltersAndTransformers] — Checks whether a given CIDR prefix is bigger than the defined maximum prefix.
CSVFeedApiModule [ApiModules] — Common code that will be appended into each CSV feed integration when it's deployed
CTF_1 [ctf01] — This should provide answers to the CTF_1.
CTF_2_BF [CTF02] — This should provide answers to the CTF_2 ( RDP BruteForce).
CTIXDeleteFlaggedIndicators [CTIX] — Deletes indicators ingested from Cyware Intel Exchange (CTIX v3) that are flagged as deprecated, revoked, false positive, reviewed, or whitelisted. All delete flags are disabled by default; the script does nothing until at least one flag is enabled.
CVSSCalculator [CommonScripts] — This script calculates the CVSS Base Score, Temporal Score, and Environmental Score using either the CVSS 3.0 or CVSS 3.1 calculator according to https://www.first.org/cvss/ calculation documentation.
CalculateEntropy [CommonScripts] — Calculates the entropy for the given data.
CalculateGeoDistance [ImpossibleTraveler] — Compute the distance between two sets of coordinates, in miles.
CalculateTimeSpan [CommunityCommonScripts] — Calculates the time span between two dates using Powershell's `New-TimeSpan` command.
A timespan with a start date of "2022-04-02T15:42:48" and end date of "2022-04-12T16:55:07" would return the following:
Days : 10
Hours : 1
Minutes : 12
Seconds : 19
Milliseconds : 0
Ticks : 8683390000000
TotalDays : 10.0502199074074
TotalHours : 241.205277777778
TotalMinutes : 14472.3166666667
TotalSeconds : 868339
TotalMilliseconds : 868339000
CalderaGetOperationReport [MitreCaldera] — Populates the Operation Facts with Facts from the MITRE Caldera
CalderaReadOnlyFields [MitreCaldera] — Prevents specific fields from being set manually.
CalderaStartOperation [MitreCaldera] — This script is used in the MITRE Caldera Operation playbook. It will auto-complete the task that waits for a specific date and time for the operation to start. It should not be used manually.
CaseMgmtAnalystTools [CaseManagement-Generic] — Dynamic display script to display a list of useful Analyst Tools on an Incident layout.
Create an XSOAR list called "Case Management Analyst Tools", and add a markdown table to provide your own list.
CaseMgmtDisplayLabels [CaseManagement-Generic] — Dynamic section that will display the Labels for an Incident in a markdown table.
CaseMgmtIncidentTypesByRole [CaseManagement-Generic] — Restricts the Incident Types a user can create manually, based on their assigned XSOAR Role(s).
Requirements - Create an XSOAR List called IncidentTypeRBAC with the following structure, the names must match exactly to the names in the Incident Types under Settings!
Example List:
{
"Default":["Case","Job","Unclassified"],
"Analyst":["Phishing","Malware"],
"ThreatHunters":["Hunt"]
}
CaseMgmtIncidentTypesDisplay [CaseManagement-Generic] — Restricts the Incident Types a user can create manually based on an XSOAR list, and prevents changing the Incident Type manually once it is created.
Requirements - Create an XSOAR List called IncidentTypesFromList a list of comma separated Incident Types
Incident Type 1,Incident Type 2, Incident Type 3.
CaseMgmtResponseProcess [CaseManagement-Generic] — Dynamic display script to display a response process on an Incident layout. The response process display can change depending on the Incident Type.
CertificateExtract [CommonScripts] — Extract fields from a certificate file and return the standard context.
CertificateReputation [CommonScripts] — Enrich and calculate the reputation of a certificate indicator.
CertificatesTroubleshoot [Troubleshoot] — Exports all certificate-related information from the Python Docker container and decodes it using RFC. It also retrieves the certificate located in the specified endpoint.
ChangeContext [CommonScripts] — Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values.
ChangeRemediationSLAOnSevChange [CommonScripts] — Changes the remediation SLA once a change in incident severity occurs.
This is done automatically and the changes can be configured to your needs.
CheckContextValue [CommonScripts] — This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values.
CheckDockerImageAvailable [Base] — Check if a docker image is available for performing docker pull. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with 'ok' if all is good otherwise will return an error.
CheckEmailAuthenticity [Phishing] — Checks the authenticity of an email based on the email's SPF, DMARC, and DKIM.
CheckFieldValue [CommonScripts] — This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value.
CheckPanosVersionAffected [PaloAltoNetworks_SecurityAdvisories] — Checks if the given PAN-OS version number is affected by the given list of vulnerabilties from the pan-advisories-get-advisories command.
CheckPivotableDomains [DomainTools_Iris] — Checks for guided pivots for a given domain.
CheckPointDownloadBackup [CheckpointFirewall] — Deprecated. Use ssh command instead. Downloads the Check Point policy backup to the Cortex XSOAR War Room.
CheckSender [Pipl] — For phishing incidents, check the sender of the email via Pipl search
CheckTags [DomainTools_Iris] — Check DomainTools domain tags and if a tag is found mark incident as high severity.
CheckpointFWBackupStatus [CheckpointFirewall] — Deprecated. Use ssh command instead. Connect to a CheckPoint firewall appliance using SSH and retrieve the status for backup tasks. The user account being used to access the device must be set to use the SSH shell and not the built-in CheckPoint CLI. For more information, consult the CheckPoint documentation.
CheckpointFWCreateBackup [CheckpointFirewall] — Deprecated. Use ssh command instead. Connect to a Check Point firewall appliance using SSH and trigger a task to create a configuration backup of the device. The user account being used to access the device must be set to use the SSH shell and not the built-in Check Point CLI. For more information, consult the CheckPoint documentation.
CherwellCreateIncident [Cherwell] — This script is an example script of how to create an incident in Cherwell. The script wraps the create business object command in the cherwell integration. When writing your own script to create a business object, follow the instructions in the configuration part, but do not change the execution section.
CherwellGetIncident [Cherwell] — This script is an example script of how to retrieve an incident from Cherwell. The script wraps the cherwell-get-business-object command of the cherwell integration. When writing your own script to get a business object, follow the instructions found in the configuration section of the script, but do not change the execution section.
CherwellIncidentOwnTask [Cherwell] — This script is an example script of how to link an incident to a task in Cherwell. The script wraps the cherwell-link-business-object command of the cherwell integration. When writing your own script to link business objects, follow the instructions found in the configuration section of the script, but do not change the execution section.
CherwellIncidentUnlinkTask [Cherwell] — This script is an example script of how to unlink a task from an incident in Cherwell. The script wraps the cherwell-unlink-business-object command of the cherwell integration. When writing your own script to unlink business objects, follow the instructions found in the configuration section of the script, but do not change the execution section.
CherwellQueryIncidents [Cherwell] — This script is an example script of how to query incidents from Cherwell. The script wraps the cherwell-query-business-object command of the cherwell integration. When writing your own script to query business objects, follow the instructions found in the configuration section of the script, but do not change the execution section.
CherwellUpdateIncident [Cherwell] — This script is an example script of how to update an incident in Cherwell. The script wraps the update-business-object command of the cherwell integration. When writing your own script to update a business object, follow the instructions found in the configuration section of the script, but do not change the execution section.
ChronicleAssetEventsForHostnameWidgetScript [GoogleChronicleBackstory] — Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.
ChronicleAssetEventsForIPWidgetScript [GoogleChronicleBackstory] — Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.
ChronicleAssetEventsForMACWidgetScript [GoogleChronicleBackstory] — Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.
ChronicleAssetEventsForProductIDWidgetScript [GoogleChronicleBackstory] — Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.
ChronicleAssetIdentifierScript [GoogleChronicleBackstory] — Collect all asset identifiers - Hostname, IP address and MAC address in the context.
ChronicleIsolatedIPWidgetScript [GoogleChronicleBackstory] — Notifies if the IP address associated with the ChronicleAsset is isolated or not.
ChronicleListDeviceEventsByEventTypeWidgetScript [GoogleChronicleBackstory] — Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.
CloseInvestigationAsDuplicate [CommonScripts] — Close the current investigation as duplicate to other investigation.
CloseLinkedIncidentsPostProcessing [CaseManagement-Generic] — Post Processing Script that will close linked Incidents when the Incident is closed. Will set the same close code as the parent, and add closing notes from the parent.
CloseSekoiaAlert [SekoiaXDR] — Post-processing script to close XSOAR incident.
CloseTaskSetContext [XMatters] — Close a task with the closeComplete command, but then also add the "comments" to the incident context.
Code42FileEventsToMarkdownTable [Code42] — Formats Code42 File Events as a markdown table for display in Code42 Alert Incidents.
CofenseTriageThreatEnrichment [CofenseTriage] — Enhancement automation for type indicator, to enrich the value from Cofense Triage.
CollectCampaignRecipients [Campaign] — Collect the recipients from all campaign incidents.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CollectPacksData [XSOARContentUpdateNotifications] — This script collects the data of packs with updates.
CommitFiles [ContentManagement] — This script gets content files as input from the context, commits the files in the correct folder and creates the pull request text.
CommonD2 [D2] — Common code that will be merged into each D2 agent script when it runs
CommonServer [Base] — Common code that will be merged into each server script when it runs.
CommonServerPowerShell [Base] — Common code that will be merged into each PowerShell script/integration when it runs.
CommonServerPython [Base] — Common code that will be merged into each server script when it runs.
CompareIncidentsLabels [CommonScripts] — Compares the labels of two incidents. Returns the labels that are unique to each incident.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CompareIndicators [DeveloperTools] — Find the differences between two indicators lists.
CompareList [CommunityCommonScripts] — Compares two lists.
CompareLists [CommonScripts] — Compare two lists and put the differences in context.
CompleteTaskOnTimerBreach [CaseManagement-Generic] — This is an SLA breach script that will complete playbook tasks tagged with 'timerbreach' when the SLA breaches.
This can be used to complete tasks waiting for manual input when a timer breaches its SLA, and move the playbook along.
ConcatFormat [FiltersAndTransformers] — Returns a string concatenated with given a prefix and suffix which supports DT expressions.
ConfigurationSetup [ContentManagement] — Configurtaion loader for the Content Management pack.
ConfigureAzureApplicationAccessPolicy [MicrosoftTeams] — This script grants a user the permissions needed to create a Teams meeting. It connects to MS Teams, creating an application access policy to a chosen application and then grants a user permissions.
ContainsCreditCardInfo [CommonScripts] — Check if a given value is true. Will return 'no' otherwise
ContentClientApiModule [ApiModules] — Async-first collector helper that standardizes auth, retries, pagination, rate limiting, logging, and metrics for collector-style integrations.
ContentDependencies [ContentTesting] — Searches a set of playbooks, or all playbooks if no playbook query is provided, and identifies all dependencies between playbooks and automations and outputs either CSV or markdown. WARNING: Should be run on DEV since it may consume 100% CPU for 10 or more minutes if all playbooks are searched.
This automation should be run in dev environments. It will consume 100% CPU for 10 minutes or more - depending on the amount of playbook and automation content. It is set to timeout at 15 minutes in Advanced settings. This may need to be increased if content amount is large. It only parses python scripts to see if additional automations/commands are invoked via demisto.executeCommand or execute_command. Javascript automations are not parsed. Command names passed in a variable to demisto.executeCommand or execute_command are not reported. If a python automation fails to parse, an error is reported in the war room: any automations it calls are not reported.
Integration commands and builtins are not parsed.
ContentPackInstaller [CommonScripts] — Content packs installer from marketplace.
ContextContains [CommonScripts] — This script searches for a value in a context path.
ContextFilter [CommonScripts] — Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it.
ContextGetEmails [CommonScripts] — Gets all email addresses in context, excluding ones given.
ContextGetHashes [CommonScripts] — Gets hashes (MD5,SHA1,SHA256) from context.
ContextGetIps [CommonScripts] — Gets all IP addresses in context, excluding ones given.
ContextGetMACAddresses [Lansweeper] — Gets all MAC addresses in context, excluding ones given.
ContextGetPathForString [CommonScripts] — Searches for string in context and returns context path, returns null if not found.
ContextReplica [ContextReplica] — Extracts the current incident context or issue context and merges with global contexts and then downloads it as a flattened JSON file. So it will be replica json data of what we see in an Incident or Issue context in UI view.
ContextSearchForString [CommonScripts] — Searches for string in a path in context. If path is null, string will be searched in full context.
ContextSetup [CortexExposureManagement] — This script simplifies how you add data to Cortex XSOAR's context. Use it to set static values or to map different values to existing context paths. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example:
`!ContextSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" context_key="key"`.
ConvertAllExcept [FiltersAndTransformers] — Convert all chosen values but exceptions.
ConvertCountryCodeCountryName [CommonScripts] — Convert country name to country code or country code to country name.
Only one of 'country_code' or 'country_name' can be provided.
Example:
Input: { "country_code": "US" }
Output: { "United States" }
Another Example:
Input: { "country_name": "United States" }
Output: { "US" }.
ConvertDatetoUTC [CommonScripts] — Converts a date from a different timezone to UTC timezone.
ConvertDomainToURLs [GoogleChronicleBackstory] — Converts Domain(s) to URL(s).
ConvertEnrichmentsToTable [CrowdStrikeFalcon] — This script is used to convert CrowdStrike IOA enrichments response elements to a table.
ConvertFile [CommonScripts] — Converts a file from one format to a different format by using the convert-to function of Libre Office. For a list of supported input/output formats see: https://wiki.openoffice.org/wiki/Framework/Article/Filter/FilterList_OOo_3_0
ConvertKeysToTableFieldFormat [FiltersAndTransformers] — Convert object keys to match table keys.
Use when mapping object/collection to table (grid) field.
(Array of objects/collections is also supported).
Example:
Input: { "Engine": "val1", "Max Results": 13892378, "Key_With^Special (characters)": true }
Output: { "engine": "val1", "maxresults": 13892378, "keywithspecialcharacters": true }
ConvertRequestParametersToTable [CrowdStrikeFalcon] — This script is used to convert CrowdStrike IOA request parameters to a table.
ConvertResourceAttributesToTable [CrowdStrikeFalcon] — This script is used to convert CrowdStrike IOM resource attributes to a table.
ConvertResponseElementsToTable [CrowdStrikeFalcon] — This script is used to convert CrowdStrike IOA response elements to a table.
ConvertTableToHTML [CommonScripts] — Converts a given array to an HTML table
ConvertTimezoneFromUTC [CommonScripts] — Takes UTC and converts it to the specified timezone. Format must match the UTC date's format and output will be the same format. Can use in conjunction with ConvertDateToString.
ConvertXmlToJson [CommonScripts] — Converts XML string to JSON format
CopyContextToField [CommonScripts] — Copy a context key to an incident field of multiple incidents, based on an incident query.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CopyFileD2 [D2] — Copy a file from an entry to the destination path on the specified system. This uses the dissolvable agent's HTTPS communication channel rather than scp or other out-of-band methods.
Example usage: !CopyFileD2 destpath=/home/sansforensics/collectedbinaries/inv8_suspiciousPE1.exe.evil entryid=21@8 system=Analyst1
CopyLinkedAnalystNotes [IntegrationsAndIncidentsHealthCheck] — Copies the anaylst notes from the integrations and incidents grid.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CopyNotesToIncident [CommonScripts] — Copy all entries marked as notes from current incident to another incident.
CoreIRApiModule [ApiModules] — Common Core IR Client, provides generic Infrastructure.
CoreIsolateEndpoint [Core] — A polling wrapper script; Isolates the specified endpoint.
CoreQuarantineFiles [Core] — A polling wrapper script; Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
CoreTerminateCausality [Core] — A polling wrapper script; Terminate a process tree by its causality ID.
CoreTerminateProcess [Core] — A polling wrapper script; Terminate a process tree by its causality ID.
CoreUnisolateEndpoint [Core] — A polling wrapper script; Unisolates the specified endpoint.
CoreXQLApiModule [ApiModules] — Common Core XQL Client provides generic infrastructure.
CortexAssistantApiModule [ApiModules] — Common utilities and classes for integrating with Cortex Assistant (AgentiX).
Provides platform-agnostic functionality that can be used across different integrations (Slack, Teams, etc.).
CortexListAppSecAssetCoverage [Core] — Retrieves Application Security Posture Management (ASPM) coverage information for assets, including scan status across different security scanning types (vulnerabilities, secrets, code weakness, IaC, malware, CICD). Returns coverage statistics, histograms, and detailed asset information. Filters can be provided to return a subset of the results. Statistics are generated over the filtered set.
CortexXDRCloudProviderWidget [CortexXDR] — This script returns an HTML result of the cloud providers in the incident. The result will be displayed in the following font colors: AWS - red, GCP - green, Azure - blue.
CreateArray [CommonScripts] — Will create an array object in context from given string input
CreateArrayWithDuplicates [CommunityCommonScripts] — Will create an array object in context from a given string input , allowing for duplicate values to be retained
Output is to ContextKey.array as JSON does not permit duplicate key names
e.g., ContextKey.array.value1, ContextKey.array.value2, ContextKey.array.value3, etc.
CreateCertificate [MicrosoftExchangeOnline] — Creates a public key (.cer file), a private key (.pfx) file, and a Base64 encoded private key to use to authenticate the EWS Extension Online Powershell v2 integration.
CreateChannelWrapper [ShiftManagement] — Creates a channel in Slack v2 or in Microsoft Teams. If both Slack v2 and Microsoft Teams are available, it creates the channel in both Slack v2 and Microsoft Teams.
CreateEDLInstance [CommunityCommonScripts] — Use this automation to create an EDL instance on XSOAR.
CreateEmailHtmlBody [CommonScripts] — This script allows sending an HTML email, using a template stored as a list item under Lists:
- Cortex XSIAM: Settings -> Configurations -> Lists.
- Cortex XSOAR: Settings -> Lists.
Placeholders are marked in DT format (i.e. ${incident.id} for incident ID).
Available placeholders for example:
- ${incident.labels.Email/from}
- ${incident.name}
- ${object.value}
See incident Context Data menu for available placeholders
Note: Sending emails require an active Mail Sender integration instance.
CreateFileFromPathObject [CommunityCommonScripts] — This automation is being executed by the "GetFilePathPreProcessing" pre-processing script that collects the paths and names of attachments of an incoming incident, then passes it to this automation that reads the files and creates them in an existing incident.
CreateHash [CommonScripts] — Creating a hash of a given input, support sha1, sha256, sha512, md5 and blake. Wrapper for https://docs.python.org/3/library/hashlib.html.
CreateHashIndicatorWrapper [Malware] — This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.
CreateIndicatorsFromSTIX [CommonScripts] — Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.x. This automation creates indicators and adds an indicator's relationships if available.
CreateNewIndicatorsOnly [CommonScripts] — Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
CreatePlbkDoc [CommunityCommonScripts] — Purpose: This automation will produce docx file detailing the tasks in the given playbook. It can produce a table or paragraph format of the report.
Author: Mahmood Azmat
Input1: Name of the playbook (Mandatory)
Input2: Format type needed. Table or Paragraph. Paragraph is default.
Input3: Name of the docx file that will be produced. Give the full name including the ".docx" extension. (Mandatory)
Requirements: This automation requires "Core REST API" integration enabled and connected to the XSOAR itself. Automation uses it to read the objects of the playbook.
CrowdStrikeApiModule [ApiModules] — Common CrowdStrike code that will be appended to each CrowdStrike integration when it is deployed to enable oauth2 authentication automatically.
CrowdStrikeStreamingPreProcessing [CrowdStrikeFalconStreamingV2] — Pre processing script for CrowdStrike Streaming, will not duplicate incidents(detection events) that have same Host.
Will add entry to duplicate(older) incident notifying a duplicate incident was ignored.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CryptoCurrenciesFormat [Cryptocurrency] — Verifies that a crypto address is valid and only returns the address if it is valid.
CsFalconLiftHostContainment [CrowdStrikeFalcon] — A polling wrapper script; lifts containment on the host, returning its network communications to normal.
CuckooDetonateFile [CuckooSandbox] — Deprecated. Use the 'cuckoo-create-task-from-file' command instead.
CuckooDetonateURL [CuckooSandbox] — Deprecated. Use 'cuckoo-create-task-from-url' instead.
CuckooDisplayReport [CuckooSandbox] — Display the contents of a Cuckoo report file from a war room entry.
CuckooGetReport [CuckooSandbox] — Deprecated. Use the 'cuckoo-get-task-report' command instead.
CuckooGetScreenshot [CuckooSandbox] — Deprecated. Use 'cuckoo-task-screenshot' command instead.
CuckooTaskStatus [CuckooSandbox] — Deprecated. Use the 'cuckoo-view-task' command instead.
CustomContentBundleWizardry [XSOAR-SimpleDevToProd] — This automation accepts an XSOAR custom content bundle, and either returns a list of file names, or the files you want to the war room.
CustomPackInstaller [ContentManagement] — Custom Packs Installer for the Content Management pack.
Cut [FiltersAndTransformers] — Cut a string by delimiter and return specific fields.
Example
=================
input: "A-B-C-D-E"
delimiter: "-"
fields: "1,5"
return: "A-E".
CyCognitoGetEndpoints [CyCognito] — Generates a deep link to the CyCognito platform using the incident context.
CybereasonPreProcessingExample [Cybereason] — Preprocessing script to run when fetching Cybereason malops.
Will check if malop was already fetched, and will then update the existing incident, otherwise will create a new incident.
CyberhavenIncidentRefresh [Cyberhaven] — Updates only Cyberhaven custom fields and never modifies the XSOAR-owned fields.
Cyren-Find-Similar-Incidents [CyrenInboxSecurity] — Finds similar incidents by Cyren Case ID
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
Cyren-Show-Threat-Indicators [CyrenInboxSecurity] — Displays threat indicators in readable format
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CyrenCountryLookup [FeedCyrenThreatInDepth] — Translates a country code provided by Cyren products to a full country name (English). Uses ISO 3166-1 alpha-2 for the lookup.
CyrenThreatInDepthRandomHunt [FeedCyrenThreatInDepth] — This script will take a random Cyren Threat InDepth feed indicator and its relationships and create a threat hunting incident for you.
The main query parameters for the resulting, internal indicator query are:
1. Seen for the first time by the feed source within the last 7 days.
2. No investigation on it yet.
3. Must have relationships to other indicators.
CyrenThreatInDepthRelatedWidget [FeedCyrenThreatInDepth] — Shows feed relationship data in a table with the ability to navigate
D2Autoruns [D2] — Used by the server-side script "Autoruns".
Uses d2 agent on endpoint to run SysInternals Autoruns.
D2Drop [D2] — Drop a file to a target system by providing its path on the server. Use CopyFileD2 instead in most cases.
This is a utility agent script to be used inside server scripts. See CopyFileD2 for an example.
D2Exec [D2] — Execute the command and pack the output back to server
D2O365ComplianceSearch [D2] — Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.
D2O365SearchAndDelete [D2] — Assign a 'Mailbox Import Export' management role to a user. This script runs through the agent on a Windows machine, pulls and executes a PowerShell script - which talks to the Exchange server.
D2PEDump [D2] — Execute PE Dump on a file that is under /tmp somewhere. Used internally by StaticAnalyze
D2RegQuery [D2] — Use the D2 agent to retrieve the value of the given registry key.
D2Rekall [D2] — Use the D2 agent to execute Rekall on a system (usually a forensics workstation) and analyze a memory dump file located on that system.
D2Remove [D2] — Deprecated. No available replacement.
D2Winpmem [D2] — Use the D2 agent to carry the winpmem binary to a system and return the memory dump file to the war room. This usually takes a while, depending on amount of RAM in the target system.
DBotAverageScore [CommonScripts] — The script calculates the average DBot score for each indicator in the context.
DBotBuildPhishingClassifier [Base] — Create a phishing classifier using machine learning technique, based on email content.
DBotClosedIncidentsPercentage [CommonScripts] — Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts.
DBotFindSimilarIncidents [Base] — Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity.
Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
DBotFindSimilarIncidentsByIndicators [Base] — Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
DBotGroupXDRIncidents [CortexXDR] — Train clustering model on Cortex XDR incident type.
DBotMLFetchData [Base] — Deprecated. No available replacement. Collect telemetry data from the environment.
DBotPreProcessTextData [Base] — Pre-process text data for the machine learning text classifier.
DBotPredictIncidentsBatch [ML] — Apply a trained ML model on multiple incidents at once, to compare incidents how the incidents were labeled by analysts, to the predictions of the model. This script is aimed to help evaluate a trained model using past incidents.
DBotPredictOutOfTheBoxV2 [ML] — Predict phishing incidents using the out-of-the-box pre-trained model.
DBotPredictPhishingLabel [DeprecatedContent] — Deprecated. This script is deprecated. See https://xsoar.pan.dev/docs/reference/playbooks/d-bot-create-phishing-classifier-v2 for more information.
DBotPredictPhishingWords [Base] — Predict text label using a pre-trained machine learning phishing model, and get the most important words used in the classification decision.
DBotShowClusteringModelInfo [Base] — Show clustering model information - model summary and incidents in specific cluster.
DBotSuggestClassifierMapping [Base] — Deprecated. No available replacement. Suggests a classifier mapping based on an advanced name matching algorithm.
DBotTrainClustering [Base] — This script helps organizes and groups incidents based on their similarities using clustering algorithms.
Clustering is a technique used to group data points (in this case, incidents) that are similar to each other into clusters.
Used to automatically categorize a large number of incidents into meaningful groups.
DSPMCheckAndSetErrorEntries [DSPM] — This script checks for error entries based on provided entry IDs and returns "yes" if any errors are found or "no" if no errors are present. If errors are detected, it sets the error messages in the XSOAR context.
DSPMCreateRiskSlackBlocks [DSPM] — This XSOAR automation script generates a Slack message block to notify users of risks detected by a Data Security Posture Management (DSPM) tool. The Slack block is dynamically constructed based on the details of the security incident and includes options for users to take specific actions, such as creating a Jira ticket or remediating the risk.
DSPMCreateSimpleSlackMessageBlock [DSPM] — This automation script overwrites the value of a specified list and sends a Slack notification to inform the user that they failed to respond to an incident notification in a timely manner. The notification includes a message indicating the end of the incident playbook and an invitation to reopen the incident if necessary.
DSPMExtractRiskDetails [DSPM] — This script extracts risk details from an incident object, processes asset tags, and sets the user's Slack email for future notifications.
It retrieves the incident details, including risk information, asset tags, and configuration details from the DSPM integration. If the asset owner's email is found, it is stored; otherwise, a default email is used. The extracted data is stored in the XSOAR context and displayed in a readable markdown format.
DSPMExtractUserResponseFromSlackBlockState [DSPM] — This script processes user responses from a Slack block interaction, determining the appropriate action based on the selected option (either creating a Jira ticket or remediating a risk). It extracts relevant project details and ticket types from the user input, sets the necessary context in XSOAR, and handles errors gracefully.
DSPMGetContianers [DSPM] — This automation script takes asset file data as input, retrieves the container names from this data, and returns a list of all containers.
DSPMIncidentList [DSPM] — This automation script manages incidents in a list by adding or deleting incidents based on the provided action.
For incidents older than the configured time limit (default is 48 hours), the script performs a cleanup by removing
the incident from the list. Additionally, the script supports adding new incidents to the list if they do not already exist.
DT [FiltersAndTransformers] — This automation allows the usage of DT scripts within playbooks transformers.
DamSensorDown [mcafeeDam] — Pre processing script for Emails from Mcafee DAM, about sensor disconnected.
Will ignore second notification, but will process first notification into incidents.
DarkmonCreateIncidents [Darkmon] — Creates one XSOAR incident per item using a name_template and field_map (comma-separated 'field=path' pairs).
DarkmonFilterCVEs [Darkmon] — Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.
DarkmonFilterUnseen [Darkmon] — Filters items by ID against an XSOAR List (state) and optionally by domain match or allowlist. Updates the List with new IDs. Outputs NewAccounts.
DarkmonLevenshtein [Darkmon] — Computes the minimum Levenshtein edit distance between a domain's root label
and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to
flag typosquatting candidates.
DarkmonScoreNRDs [Darkmon] — For each NRD, calls DarkmonLevenshtein against the brands list and emits Typosquats with distance <= max_distance.
DarkmonVIPFanOut [Darkmon] — For each protected email, calls dmontip-get-boardemails three times (accounts, combo-lists, public-breaches), filters new entries, creates incidents.
DatadogSyncIncidentFields [DatadogCloudSIEM] — Fetches the latest Datadog Security Signal data and updates incident fields.
DataminrPulseCVSSColor [DataminrPulse] — This dynamic automation parses the CVSS Score of a CVE and presents it in the layout with color.
DataminrPulseCyberDiscoveredEntities [DataminrPulse] — This dynamic automation update the intel agents cyber discovered entities data to HTML and presents it in the layout in color according to theme.
DataminrPulseEPSSScore [DataminrPulse] — This dynamic automation parses the EPSS Score of a CVE and presents it in the layout.
DataminrPulseImpactedAssets [DataminrPulse] — This dynamic automation update the impacted assets data to HTML and presents it in the layout.
DataminrPulseIntelAgents [DataminrPulse] — This dynamic automation update the intel agents data to HTML and presents it in the layout in color according to theme.
DataminrPulseIntelAgentsCyberContext [DataminrPulse] — This dynamic automation update the intel agents cyber context data to HTML and presents it in the layout in color according to theme.
DataminrPulseIntelAgentsPhysicalContext [DataminrPulse] — This dynamic automation update the intel agents physical context data to HTML and presents it in the layout in color according to theme.
DataminrPulseLiveBrief [DataminrPulse] — This dynamic automation update the live brief data to HTML and presents it in the layout in color according to theme.
DataminrPulsePhysicalDiscoveredEntities [DataminrPulse] — This dynamic automation update the intel agents physical discovered entities data to HTML and presents it in the layout in color according to theme.
DataminrPulseTransformExtractedIndicatorsToList [DataminrPulse] — Script used to transform result received from the extractIndicators (Builtin) script from the dictionary of indicators to a list of indicators.
DateStringToISOFormat [FiltersAndTransformers] — This is a thin wrapper around the `dateutil.parser.parse` function. It will parse a string containing a date/time stamp and return it in ISO 8601 format.
DateTimeNowToEpoch [CommunityCommonScripts] — Returns the current datetime as an epoch value for use in timestamp comparisons.
DateTimeToADTime [CommunityCommonScripts] — Converts unix time to AD Integer8 time. This is used in many AD date fields like pwdLastSet.
DateTimeToLDAPTime [CommunityCommonScripts] — Converts the given time to an LDAP timestamp.
DateToTimeStamp [RubrikPolaris] — Converts a date to timestamp.
DedupBy [FiltersAndTransformers] — This transformer will remove elements of the array that contain an identical combination of values for the keys given.
DeduplicateValuesbyKey [CommonScripts] — Given a list of objects and a key found in each of those objects, return a unique list of values associated with that key. Returns error if the objects provided do not contain the key of interest.
Defang [CommunityCommonScripts] — Defangs IP, Mail and URL address to prevent them from being recognized.
DeleteContent [ContentManagement] — Delete content to keep XSOAR tidy.
DeleteContext [CommonScripts] — Delete field from context.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
DeleteIncidentsByQuery [CommunityCommonScripts] — Use this automation to delete incidents using query parameter with the same format as used in incidents search. Core REST API integration instance should be created.
DeleteIndicatorRelationships [Base] — This automation allows to delete a relationship between indicator objects based on the relationship id.
DeleteIndicators [CommunityCommonScripts] — Delete indicators based on query, values, or IDs.
DeleteReportedEmail [Phishing] — Use this script to delete a reported phishing email from the mailbox it was reported to.
DemistoVersion [CommonScripts] — Return the Demisto server version.
DiagnoseSyslogCollector [Core] — Diagnoses why the syslog collector on a specified Broker VM is failing by checking broker status and collection_auditing logs.
Dig [CommonScripts] — DNS lookup utility to provide 'A' and 'PTR' record.
DisableUserWrapper [CommonScripts] — This script allows disabling a specified user using one or more of the following integrations: SailPointIdentityIQ, ActiveDirectoryQuery, Okta, MicrosoftGraphUser, and IAM.
DisplayCVEChartScript [RiskSense] — Display bar chart based on cves count and trending cves count with the different colors.
DisplayEmailHtml [EmailCommunication] — Displays the original email in HTML format.
DisplayEmailHtmlThread [EmailCommunication] — Dynamic-section script for 'Email Threads' layout.
This script renders all email messages with the thread number specified in the "Email Selected Thread" field and outputs them as a single HTML output.
DisplayHTML [CommonScripts] — Display HTML in the War Room.
DisplayIndicatorReputationContent [CommunityCommonScripts] — Display the indicator context object in markdown format in a dynamic section layout.
DisplayTaggedWarroomEntries [CommunityCommonScripts] — Display warroom entries in a dynamic section which are tagged with 'report'.
DlpAskFeedback [Palo_Alto_Networks_Enterprise_DLP] — Sends a message via Slack or MS Teams to the user whose activity violated DLP policies and triggered the incident.
DockerHardeningCheck [CommonScripts] — Checks if the Docker container running this script has been hardened according to the recommended settings at:
- For Docker hardening guide (Cortex XSOAR 6.13) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide
- For Docker hardening guide (Cortex XSOAR 8 Cloud) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Docker-hardening-guide
- For Docker hardening guide (Cortex XSOAR 8.7 On-prem) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Docker-hardening-guide.
DocumentationAutomation [DeprecatedContent] — Deprecated. The recommended way to generate documentation is via the demisto-sdk.
See: https://xsoar.pan.dev/docs/integrations/integration-docs
DomainExtractAndEnrich [DomainTools_Iris] — Resolves a URL or fully qualified domain name (FQDN) and looks up a complete profile of the domain on the DomainTools Iris Enrich API.
DomainExtractAndInvestigate [DomainTools_Iris] — Resolves a URL or fully qualified domain name (FQDN) and looks up a complete profile of the domain on the DomainTools Iris Investigate API.
DomainReputation [CommonScripts] — A context script for Domain entities.
DownloadAndArchivePythonLibrary [CommonScripts] — The script downloads a Python library using PIP, archives it, and returns the file to the war room.
DrawRelatedIncidentsCanvas [Base] — Draw incidents and indicators on the canvas to map and visualize their connections.
DsSearchQueryArray [DigitalShadows] — Combines an array of queries to as few as possible whilst staying under the maximum term count.
DumpJSON [CommonScripts] — Dumps a json from context key input, and returns a json object string result.
EPOFindSystem [epo] — Deprecated. Use the "McAfe ePO v2 integration command epo-find-system" instead.
Return system info
EWSApiModule [ApiModules] — EWS Api Module, provides EWSClient and other generic logic to EWS integrations.
EditServerConfig [CommonScripts] — Edit the server configuration (under *settings/troubleshooting*). You can either add a new configuration or update and remove an existing one.
EmailAskUser [CommonScripts] — Ask a user a question via email and process the reply directly into the investigation.
EmailAskUserResponse [CommonScripts] — Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply.
EmailDomainBlacklist [FiltersAndTransformers] — Accepts an array of domains as a block list, and a list of email addresses. The script then filters out any email address whose domain is in the block list. The filtered list will be returned as an array.
EmailDomainSquattingReputation [CommonScripts] — Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm.
EmailDomainWhitelist [FiltersAndTransformers] — Accepts an array of domains as an allow list, and a list of email addresses. The script then filters out any email address whose domain is not in the allow list. The filtered list will be returned as an array.
EmailReputation [CommonScripts] — A context script for Email entities.
EmailSLABreach [XsoarWebserver] — This is used to complete the Scheduled command if the either/both the users respond in time. The time is configured on the EmailUserSLA.
EncodeToAscii [CommonScripts] — Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII).
EntryWidgetCoAHandled [MITRECoA] — Entry widget that shows the number of techniques that were already handled by the CoA playbooks.
EntryWidgetCoATechniquesList [MITRECoA] — Entry widget that shows the number of techniques that were not yet handled by the CoA playbooks.
EntryWidgetNCSCResultsA [NCSCCyberAsssessmentFramework] — This script populates results for the dynamic content shown in the incident layout.
EntryWidgetNCSCResultsB [NCSCCyberAsssessmentFramework] — This script populates results for the dynamic content shown in the incident layout.
EntryWidgetNCSCResultsC [NCSCCyberAsssessmentFramework] — This script populates results for the dynamic content shown in the incident layout.
EntryWidgetNCSCResultsD [NCSCCyberAsssessmentFramework] — This script populates results for the dynamic content shown in the incident layout.
EntryWidgetNumberHostsXDR [CortexXDR] — Entry widget that returns the number of hosts in a Cortex XDR incident.
EntryWidgetNumberUsersXDR [CortexXDR] — Entry widget that returns the number of users that participated in a specified Cortex XDR incident.
EntryWidgetPieAlertsXDR [CortexXDR] — Entry widget that returns a pie chart of alerts for a specified Cortex XDR incident by alert severity (low, medium, and high).
EntryWidgetPortBasedRules [PANOSPolicyOptimizer] — Entry widget that returns the number of port based rules found by PAN-OS policy optimizer.
EntryWidgetRegionNameXCLOUD [CloudIncidentResponse] — Entry widget that returns the region involved in the alert.
EntryWidgetResourceTypeXCLOUD [CloudIncidentResponse] — Entry widget that returns the resource type involved in the alert.
EntryWidgetUnusedApplications [PANOSPolicyOptimizer] — Entry widget that returns the number of rules with unused applications found by PAN-OS policy optimizer.
EntryWidgetUnusedRules [PANOSPolicyOptimizer] — Entry widget that returns the number of unused rules found by PAN-OS policy. optimizer.
EnumerateRoles [TeamManagement] — The script will enumerate any provided role names and output the list of users for each role.
Etl2Pcap [WindowsForensics] — Receives an ETL file and converts it to a PCAP file.
EvaluateContextValue [CommonScripts] — The script is for use with GenericPolling, which checks the completion condition. It uses a DT to retrieve a value from the context data and evaluates it using another DT.
ExampleJSScript [CommonScripts] — This is only an example script, to showcase how to use and write JavaScript scripts
ExecuteCommandAt [CommonScripts] — A wrapper script for the executeCommandAt command to be used in playbooks or the war-room.
ExifRead [CommonScripts] — Read image files metadata and provide Exif tags.
Exists [CommonScripts] — Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
ExpanseAggregateAttributionCI [ExpanseV2] — Deprecated. No available replacement. > Aggregate entries from ServiceNow CMDB into AttributionCI.
ExpanseAggregateAttributionDevice [ExpanseV2] — Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionDevice.
ExpanseAggregateAttributionIP [ExpanseV2] — Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionIP.
ExpanseAggregateAttributionUser [ExpanseV2] — Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionUser.
ExpanseEnrichAttribution [ExpanseV2] — Deprecated. No available replacement. > This script can be used to enrich context generated by ExpanseAggregateAttribution* scripts with additional details
ExpanseEvidenceDynamicSection [ExpanseV2] — Deprecated. No available replacement. > Dynamic Section script used in Expanse Issue layout to display the Latest Evidence structure.
ExpanseGenerateIssueMapWidgetScript [ExpanseV2] — Deprecated. No available replacement.
This widget script generates a map of the Open Expanse Issue Incidents with provider On Prem.
The map is generated as a static PNG file embedded in Markdown.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ExpansePrintSuggestions [ExpanseV2] — Deprecated. No available replacement. > Generates and prints a report in markdown format containing useful suggestions for the Analyst to attribute an Expanse Issue to an owner.
ExpanseRefreshIssueAssets [ExpanseV2] — Deprecated. No available replacement. > Script to refresh tags and attribution reasons of assets inside Expanse Issue. The script should be used inside the Expanse Issue incident context.
ExportAuditLogsToFile [CommonScripts] — Uses the Core REST API integration to query the server audit trail logs, and return back a CSV or JSON file.
ExportContextToJSONFile [CommonScripts] — Exports the Context for the current Incident to a JSON file in the war room.
ExportIncidentsToCSV [CommonScripts] — This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room.
ExportIndicatorsToCSV [CommonScripts] — This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.
ExportMLModel [ML] — Exports an existing ML model to a file.
ExportToCSV [CommonScripts] — Export given array to csv file.
ExportToXLSX [CommonScripts] — Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file.
ExposeIncidentOwner [CommonScripts] — Expose the incident owner into IncidentOwner context key
ExtFilter [CommunityCommonScripts] — Advanced Filter. It enables you to make filters with complex conditions.
ExtendQueryBasedOnPhishingLabels [ML] — A helper script for the DBot Create Phishing Classifier V2 playbook. This script extends the query based on the phishingLabels argument.
ExtraHopTrackIncidents [ExtraHop] — Links an incident investigation back to the ExtraHop Detection that created it.
ExtractAttackPattern [CommonScripts] — Extract Attack Pattern Threat Intel Object. After auto extract extracts the Attack Pattern IDs, this script is executed and extracts the value (name) of the Attack Pattern.
ExtractHTMLTables [CommonScripts] — Find tables inside HTML and extract the contents into objects using the following logic:
- If table has a single column, just create an array of strings from the values
- If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value
- If table has a header row, create a table of objects where attribute names are the headers
- If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3...
ExtractInbetween [FiltersAndTransformers] — Extract a string from an existing string.
ExtractIndicators-CloudLogging [CloudIncidentResponse] — This script will extract indicators from a given AWS CloudTrail or GCP Logging event.
ExtractIndicatorsFromTextFile [CommonScripts] — Extract indicators from a text-based file.
Indicators that can be extracted:
* IP
* Domain
* URL
* File Hash
* Email Address
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ExtractIndicatorsFromWordFile [CommonScripts] — Used to extract indicators from Word files (DOC, DOCX).
The script does not extract data from macros (e.g., embedded code).
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ExtractUsernames [GoogleDorking] — Extract strings suspected as a user from a given file or text.
FPDeleteRule [Forcepoint] — Deletes a rule in Forcepoint Triton.
FPSetRule [Forcepoint] — Adds (or updates existing) rule in Forcepoint Triton. Preserves order of rules and modifies policy in-place if a rule exists with the exact type and value.
FactAboutYou [DBotTruthBombs] — Reveal some facts about yourself.
FailedInstances [CommonScripts] — Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances.
FeedCyCognitoGetAssetEndpoint [FeedCyCognito] — Generates a deep link to the CyCognito platform using the indicator context.
FeedIntegrationErrorWidget [CommonWidgets] — Returns a table widget of enabled feed integration instances that errors out on indicators fetch.
FeedRelatedIndicatorsWidget [CommonScripts] — Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant.
FetchFileD2 [D2] — Get a File from using a D2 agent
FetchFromInstance [DeveloperTools] — Execute FetchIncident for a given instance
FetchIndicatorsFromFile [CommonScripts] — Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types.
FileCreateAndUpload [CommonScripts] — Deprecated. Use FileCreateAndUploadV2 instead. Will create a file (using the given data input or entry ID) and upload it to current investigation war room.
FileCreateAndUploadV2 [CommonScripts] — Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room.
FileReputation [CommonScripts] — A context script for hash entities.
FileToBase64List [CommonScripts] — Encode a file as base64 and store it in a Demisto list.
FilterByList [CommonScripts] — Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist.
FindDuplicateEmailIncidents [Phishing] — Can be used to find duplicate emails for incidents of type phishing, including malicious, spam, and legitimate emails.
FindEmailCampaign [Campaign] — Find a campaign of emails based on their textual similarity.
FindPlaybookCustomDependencies [CommunityCommonScripts] — Find custom scripts and integration dependencies used inside of playbooks.
FindSimilarIncidents [CommonScripts] — Deprecated. Use DBotFindSimilarIncidents instead.
Finds similar incidents by common incident keys, labels, custom fields or context keys.
It's highly recommended to use incident keys if possible (e.g., "type" for the same incident type).
For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label).
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
FindSimilarIncidentsByText [Base] — Deprecated. Use DBotFindSimilarIncidents instead.
Find similar incidents by text comparison - the algorithm based on TF-IDF method.
To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf
This automation runs using the default Limited User role, unless you explicitly
change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
FireEyeApiModule [ApiModules] — Common FireEye code that will be appended to each FireEye integration when it is deployed.
FirstArrayElement [FiltersAndTransformers] — Returns the first element of an array. If the value passed is not an array, it returns the original value that was passed.
FlashpointVulnerabilityDetails [Flashpoint] — Retrieves the CVE information for vulnerabilities present in the incident and updates the vulnerability details in the incident data.
FormatACTIURL [AccentureCTI] — Helps to fetch ACTI Intelligence Report/Alert URL and converts it to uuid.
FormatContentData [XSOARContentUpdateNotifications] — This script formats the value given input from a JSON list into table.
FormatTemplate [FiltersAndTransformers] — Build text from a template that can include DT expressions.
FormatURL [CommonScripts] — Strips, unquotes and unescapes URLs. If the URL is a Proofpoint or ATP URL, extracts its redirect URL. If more than one URL is passed to the formatter, the separator must be a pipe ("|").
FormattedDateToEpoch [FiltersAndTransformers] — Converts a custom-formatted timestamp to UNIX epoch time. Use it to convert custom time stamps to a XSOAR date field. If you pass formatter argument, we will use it to transform. If not, we will use dateparser.parse for transforming. For more info, see: https://docs.python.org/3.7/library/datetime.html#strftime-and-strptime-behavior
ForwardAuditLogsToSplunkHEC [ForwardXSOARAuditLogsToSplunkHEC] — This Automation script uses the XSOAR API to get the audit logs and pushes them to Splunk HEC. Dependencies: SlunkPy and Core REST API integrations.
GCPOffendingFirewallRule [GCP-Enrichment-Remediation] — Determine potential offending firewall rules in GCP based on port, protocol and possibly target tags (network tags).
Considerations:
- At this time this automation only find potential offending rules and not necessarily the rule that is matching traffic.
GCPProjectHierarchy [GCP-Enrichment-Remediation] — Determine GCP project hierarchy by looking up parent objects until the organization level is reached.
GDPRContactAuthorities [GDPR] — GDPR Data Protection Supervisory Authority Listing.
"'supervisory authority' means an independent public authority which is established by a Member State pursuant to
Article 51.
'supervisory authority concerned' means a supervisory authority which is concerned by the processing of personal
data because:
(a) the controller or processor is established on the territory of the Member State of that supervisory authority.
(b) data subjects residing in the Member State of that supervisory authority are substantially affected or likely
to be substantially affected by the processing, or
(c) a complaint has been lodged with that supervisory authority."
GDPR - Art. 4 - https://gdpr-info.eu/art-4-gdpr/
GIBDRPIncidentUpdate [GroupIB_DigitalRiskProtection] — This script prevents duplication of existing incidents.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
GIBIncidentUpdate [GroupIB_ThreatIntelligenceAttribution] — This script prevents duplication of existing incidents.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdateAllTypes [GroupIB_ThreatIntelligenceAttribution] — This script prevents duplication of existing incidents.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GIBIncidentUpdateIncludingClosed [GroupIB_ThreatIntelligenceAttribution] — This script prevents duplication of existing incidents.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GLPIIncidentStatus [GLPI] — populates the value of the GLPI Ticket State field and display it in a layout widget.
GenerateASMReport [CortexAttackSurfaceManagement] — Generate an ASM Alert Summary report.
GenerateAsBuilt [CommonScripts] — Generate an as built document, as HTML, based on the running XSOAR instance. Requires an instance of the Demisto API integration configured.
GenerateAsBuiltConfiguration [CommonScripts] — Generate a JSON file that can be downloaded and used to create the As-Built document for Cortex XSOAR.
GenerateCSR [SSLCertificates] — Generates a certificate signing request for fulfillment by an organization certification authority (CA)
Output is the request.csr file placed directly into context under a "File" object.
GenerateInvestigationSummaryReport [CommonScripts] — A script to generate investigation summary report in an automated way
Can be used in post-processing flow as well.
GeneratePassword [CommonScripts] — This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of *random length* including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class.
The min_* values all default to 0. This means that if the command is executed in this way:
!GeneratePassword max_lcase=10
It is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches.
The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics.
GenerateRandomJSON [CommunityCommonScripts] — Generate a list of random dictionaries, using Faker Python library. For more information, please visit https://faker.readthedocs.io
GenerateSummaryReportButton [CommonScripts] — This button will generate summary 'Case Report' template for a given Incident.
GenerateSummaryReports [CommonScripts] — Generate report summaries for the passed incidents.
GenericPollingScheduledTask [CommonScripts] — Runs the polling command repeatedly, completes a blocking manual task when polling is done.
GetAskLinks [CommunityCommonScripts] — Creates external ask links for the `Ask` task with the given name.
GetAwayUsers [ShiftManagement] — Returns a list of all the users marked as away in Cortex XSOAR.
GetBrandDeleteReportedEmail [Phishing] — Gets all the enabled instances of integrations that can be used by the DeleteReportedEmail script, in the output format of a single select field.
GetByIncidentId [CommonScripts] — Gets a value from the specified incident's context.
GetCampaignDuration [Campaign] — Calculate the duration of the current campaign and returns the result in a string with HTML format.
GetCampaignIncidentsInfo [Campaign] — Get the campaign incidents information as a MD table.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetCampaignLowSimilarityIncidentsInfo [Campaign] — Gets the campaign incidents with low similarity information as a markdown table.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetCampaignLowerSimilarityIncidentsIdsAsOptions [Campaign] — Gets the IDs of incidents with lower similarity. Used to fill the optional values of the multi-select "Phishing Campaign Select Campaign Lower Similarity Incidents" incident field.
GetCaseExtraData [CommonScripts] — Retrieves extra data fields of a specific case, including issues and key artifacts.
GetCiscoISEActiveInstance [PaloAltoNetworks_IoT3rdParty] — Determines which configured Cisco ISE instance is in active/primary state and returns the name of the instance.
GetDataCollectionLink [CommonScripts] — Generates the URL for a Data Collection Task into Context. Can be used to get the url for tasks send via Email, Slack, or even if you select "By Task Only".
To generate links for specific users, add an array of users in the users argument.
GetDockerImageLatestTag [CommonScripts] — Gets docker image latest tag. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with the docker image latest tag if all is good, otherwise will return an error.
GetDuplicatesMlv2 [CommonScripts] — Deprecated. Use the "PhishingDedupPreprocessingRule" script instead.
Find duplicate incidents candidates.
Using machine learning techniques with pre-defined data (can also use data from the local environment), this script takes into consideration different features such as: labels comparison, email labels (relevant for phishing), incident time difference and shared indicators, which can be customized by the arguments.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetEWSFolder [MicrosoftExchangeOnline] — Get emails from multiple folders of an account all at once.
GetEnabledInstances [CommonScripts] — Gets all currently enabled integration instances.
GetEntries [CommonScripts] — Collect entries matching to the conditions in the war room.
GetErrorsFromEntry [CommonScripts] — Get the error(s) associated with a given entry/entries. Use ${lastCompletedTaskEntries} to check the previous task entries. The automation will return an array of the error contents from those entries.
GetFailedTasks [IntegrationsAndIncidentsHealthCheck] — Gets failed tasks details for incidents based on a query. Limited to 1000 incidents.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetFields [CommunityCommonScripts] — Retrieves fields from an object using dot notation.
GetFieldsByIncidentType [CommonScripts] — Returns the incident field names associated to the specified incident type.
GetFilePathPreProcessing [CommunityCommonScripts] — This is a pre-processing script that is used to create the attachments of incoming incidents in an existing incident, then drop the incoming incident.
It should be configured as a pre-processing rule, and the logic for finding the right incident should be added to the code manually.
The automation collects the paths and names of the attachments of the incoming incident and passes it to the "CreateFileFromPathObject" automation that is being executed on the existing incident.
GetIdsFromCustomContent [ContentManagement] — Extract custom content IDs from custom content bundle file and exclude IDs as specified.
GetIncidentTasks [DemistoRESTAPI] — Get all tasks for a specific incident by the given state, name and/or tag.
GetIncidentTasksByState [DemistoRESTAPI] — Deprecated. Use the GetIncidentTasks script instead.
GetIncidentsApiModule [ApiModules] — Common code that is appended into scripts which require searching incidents.
GetIncidentsByQuery [Base] — Gets a list of incident objects and the associated incident outputs that
match the specified query and filters. The results are returned in a structured data file.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetIndexOfArrayValue [CommunityCommonScripts] — This transformer will get an index of an element from an array.
ex:["phishing","Malware"], if we provide "Malware" to array_value argument, will get index as 1.
GetIndicatorCustomFieldsByQuery [CommunityCommonScripts] — Returns indicator custom fields into the context by the given query.
GetIndicatorDBotScore [CommonScripts] — Add into the incident's context the system internal DBot score for the input indicator.
GetIndicatorDBotScoreFromContext [CommunityCommonScripts] — Get the final verdict from the DBotScore of the context.
Provided that it has all of the latest source verdict, this script gives you the right final verdict.
GetIndicatorsByQuery [Base] — Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.
GetInstanceName [DeveloperTools] — Given an integration name, returns the instance name.
GetInstances [CommonScripts] — Returns integration instances configured in Cortex XSOAR. You can filter by instance status and/or brand name (vendor).
GetLatestReleaseNotes [XSOARContentUpdateNotifications] — This script retrieves the latest release notes for selected packs.
GetLicenseID [CommonScripts] — Returns the license ID.
GetListContent [FiltersAndTransformers] — Returns the content of the List with the given Name as a string or JSON object, depending on the selected `type`.
GetListDatawithKeyword [CommunityCommonScripts] — This transformer will get list of array elements by providing keyword. List data format
[
{
"folder": "abc",
"username": "test"
},
{
"folder": "def",
"username": "test123"
},
{
"folder": "ghi",
"username": "admin"
}
]
GetListRow [CommonScripts] — Parses a list by header and value.
GetMLModelEvaluation [Base] — Finds a threshold for ML model, and performs an evaluation based on it.
GetMessageIdAndRecipients [CofenseVision] — Get the Internet Message Id and Recipient's address of Messages in a format of `internet_message_id:recipients_address.`.
GetNumberOfUsersOnCall [ShiftManagement] — Retrieves the number of users who are currently on call.
GetOnCallHoursPerUser [ShiftManagement] — Retrieves the number of on call hours per user.
GetPrBranches [ContentManagement] — Field-display script that gets the branch names from "Pull Request Creation" incidents to use in the "Pull Request Branch" incident field.
GetProjectOwners [CortexAttackSurfaceManagement] — Parse a GCP service account email for the project name, then lookup project owners and add them to a list of potential service owners for ranking.
GetRange [FiltersAndTransformers] — Gets specified indexes of a list.
GetRolesPerShift [ShiftManagement] — Retrieves the roles that are available per shift.
GetSendEmailInstances [Campaign] — Gets all the enabled instances of integrations that have a send-mail command, in the output format of a single select field.
GetServerInfo [DeveloperTools] — Get version and URL of current XSOAR server.
GetServerURL [CommonScripts] — Get the Server URL.
GetShiftsPerUser [ShiftManagement] — Retrieves the number of on-call hours per user.
GetSlackBlockBuilderResponse [Slack] — GetSlackBlockBuilderResponse will format a SlackBlockBuilder response and insert it into an incident's context.
GetStringsDistance [CommonScripts] — Get the string distance between inputString and compareString (compareString can be a comma-separated list) based on Levenshtein Distance algorithm.
GetTasksWithSections [DemistoRESTAPI] — Groups all tasks for a specific incident according to the task headers (titles).
GetTime [CommonScripts] — Retrieves the current date and time.
GetUsersOOO [ShiftManagement] — Retrieves users who are currently out of the office. The script use the OutOfOfficeListCleanup script to remove users from the out-of-office list whose 'off until day' is in the past.
GetUsersOnCall [ShiftManagement] — Retrieves users who are currently on call.
GetValuesOfMultipleFields [FiltersAndTransformers] — The script receives a list of fields and a context key base path. For example, Key=Test.result List=username,user gets all of the values from Test.result.username and Test.result.user.
The Get field of the task must have the value ${.=[]}.
GoogleDriveApiModule [ApiModules] — Common Google Drive code that will be appended into the Google Drive integrations when it's deployed.
GoogleSecOpsSyncCaseInformation [GoogleChronicleBackstory] — Syncs the latest case information, related alerts and alert entities from Google SecOps and updates the Cortex XSOAR incident data.
GreaterCidrNumAddresses [FiltersAndTransformers] — Check if number of availble addresses in IPv4 or IPv6 CIDR is greater than given number.
GridFieldSetup [CommonScripts] — Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. Instead of a value you can enter `TIMESTAMP` to get the current timestamp in ISO format. For example:
`!GridFieldSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" gridfiled="gridfield"`.
Group [CommunityCommonScripts] — Splits a list into smaller groups (chunks) of a specified size.
GrrGetFiles [GRR] — Deprecated. Use grr_get_files instead.
GrrGetFlows [GRR] — Deprecated. Use grr-get-flows instead.
GrrGetHunt [GRR] — Deprecated. Use grr_get_hunt instead.
GrrGetHunts [GRR] — Deprecated. Use grr_get_hunts instead.
GrrSetHunts [GRR] — Deprecated. Use grr_set_hunts instead.
HTMLDocsAutomation [DeprecatedContent] — Deprecated. The recommended way to generate documentation is via the demisto-sdk.
See: https://xsoar.pan.dev/docs/integrations/integration-docs
HTMLtoMD [CommonScripts] — Converts HTML to Markdown.
HTTPFeedApiModule [ApiModules] — Common HTTP feed code that will be appended into each HTTP feed integration when it's deployed.
HTTPListRedirects [CommonScripts] — List the redirects for a given URL.
HashIncidentsFields [ML] — Hash fields from the incident list.
Search for incidents by arguments with an option to hash some of its fields.
HealthCheckAPIvalidation [HealthCheck] — Validate if API Integration was defined correctly.
If not detect what is the problem and warn about it.
HealthCheckExportSummaryData [HealthCheck] — Export all Incident, Context and Widget data into Json format output.
HealthCheckFields [HealthCheck] — Parsing custom fields to detect indexed fields for risky field types.
HealthCheckIncidentTypes [HealthCheck] — Identify custom and detached system incidents type
Checking if 'Auto Extraction' is turned on for:
Extract from all
Extract from specific indicators doesn't have any settings.
Hey [DeveloperTools] — Use rakyll/hey to test a web application with a load of requests.
HighlightWords [Base] — Highlight words inside a given text.
HtmlDifflabDynamic [SuspiciousDomainHunting] — This dynamic automation parses the difflib results and presents it in the layout in color according to its score.
HtmlDifflibCheck [SuspiciousDomainHunting] — Compares two HTML source as strings and returns a similarity score using difflib.
HtmlPhishingCheck [SuspiciousDomainHunting] — Checks if a URL contains HTML elements indicative of phishing.
HttpV2 [CommonScripts] — Sends a HTTP request with advanced capabilities.
HuntingFromIndicatorLayout [ProactiveThreatHunting] — This automation creates an incident from the indicator layouts Malware, Campaign and Intrusion set, with the following parameters:
- Name: Threat Hunting Session - <Indicator Value>
- Type: Proactive Threat Hunting
- sdoname: <Indicator Value>.
IAMApiModule [ApiModules] — Common code that will be appended into each IAM integration when it's deployed.
IAMInitADUser [Active_Directory_Query] — Generates password,
Set an AD user account with this password.
Enable the account.
Send mail to the user with the account information.
This script is running `send-mail` command, make sure there is a matching Integration configured.
IAMInitOktaUser [Okta] — Generates a password and sets the password for an Okta user.
Enables the account.
Sends an email to the user with the account information.
This script is running the `send-mail` command, make sure there is a mail sender integration configured.
IPCalcCheckSubnetCollision [CommunityCommonScripts] — An automation script to return subnet collision result.
IPCalcReturnAddressBinary [CommunityCommonScripts] — An automation script to return address in binary format.
IPCalcReturnSubnetNetwork [CommunityCommonScripts] — An Automation Script to return subnet network ID.
IPNetwork [CommonScripts] — Gather information regarding CIDR -
1. Broadcast_address
2. CIDR
3. First_address
4. Last address
5. Max prefix len
6. Num addresses
7. Private
8. Version.
IPReputation [CommonScripts] — A context script for IP entities.
IPToHost [CommonScripts] — Try to get the hostname correlated with the input IP.
IPv4Blacklist [FiltersAndTransformers] — Transformer that returns a filtered list of IPv4 addresses, based on whether they do not match a comma-separated list of IPv4 ranges. Useful for filtering out internal IP address space.
IPv4Whitelist [FiltersAndTransformers] — Transformer that returns a filtered list of IPv4 addresses, based on whether they match a comma-separated list of IPv4 ranges. Useful for filtering in internal IP address space.
IbmAddNote [IBMResilientSystems] — Use this script to add a note entry in Cortex XSOAR, which will then be mirrored as a note to an IBM QRadar SOAR incident. This script should be run within an incident.
IbmAddTask [IBMResilientSystems] — Use this script to add a task to an IBM QRadar SOAR incident.
IbmConvertArtifactsToTable [IBMResilientSystems] — This script is used to format IBM QRadar SOAR Artifacts into a markdown table.
IbmConvertAttachmentsToTable [IBMResilientSystems] — This script is used to convert IBM QRadar SOAR attachments to a markdown table.
IbmConvertCommentsToTable [IBMResilientSystems] — This script is used to convert IBM QRadar SOAR notes to a markdown table.
IbmConvertTasksToTable [IBMResilientSystems] — This script is used to convert IBM QRadar SOAR tasks to a markdown table.
IbmUpdateNote [IBMResilientSystems] — Use this script to add a note entry in Cortex XSOAR, which will then be mirrored as a note to an IBM QRadar SOAR incident. This script should be run within an incident.
IbmUpdateTask [IBMResilientSystems] — Use this script to add a note entry in Cortex XSOAR, which will then be mirrored as a note to an IBM QRadar SOAR incident. This script should be run within an incident.
IbmUploadAttachment [IBMResilientSystems] — Use this script to upload an attachment to an IBM QRadar SOAR incident. This script should be run within an incident.
IdentifyAttachedEmail [CommonScripts] — Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.
If-Elif [FiltersAndTransformers] — A transformer for if-elif-else logic.
If-Then-Else [FiltersAndTransformers] — A transformer for simple if-then-else logic.
IgnoreFieldsFromJson [FiltersAndTransformers] — Removed selected fields from the JSON object.
ImpSfListEndpoints [Imperva_Skyfence] — The endpoints list request enables a client application to receive a list of all managed and unmanaged endpoints, with their basic details. This list can then be externally filtered or searched by the application to identify individual endpoints that might require action. For any such endpoint, the application can obtain fuller details (see Endpoint Details Request below) and if relevant change its enrollment status.
ImpSfRevokeUnaccessedDevices [Imperva_Skyfence] — Getting all devices data from server, if a device haven't been accessed to in over two months (and is still managed), the script will send the corresponding user a warning mail.
If it's haven't been accessed to in over three months, the script will revoke the device credentials and notify the user by mail.
ImpSfScheduleTask [Imperva_Skyfence] — Creating a schedule task that's call ImpSfRevokeUnaccessedDevices:
Getting all devices data from server, if a device haven't been accessed to in over two months (and is still managed), the script will send the corresponding user a warning mail.
If it's haven't been accessed to in over three months, the script will revoke the device credentials and notify the user by mail.
ImpSfSetEndpointStatus [Imperva_Skyfence] — Deprecated. Call imp-sf-set-endpoint-status directly. No available replacement.
ImportMLModel [ML] — Imports a file that contains an ML model.
IncapScheduleTask [Incapsula] — This script periodically runs the "IncapWhitelistCompliance" script, which queries the Incapsula monitored websites for white-list compliance (see script for further details).
The script then saves the new periodic ID into incident context under the "ScheduleTaskID" key for later use.
IncapWhitelistCompliance [Incapsula] — Get all sites from Incapsula.
For each site, the script, through a ssh server (one that should NOT be in the allow list), make sure the site is compliant ( allow list is being enforced ).
If not, a warning mail will be sent to the domain owner.
IncidentAddSystem [CommonScripts] — Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system)
IncidentFields [CommonScripts] — Returns a dict of all incident fields that exist in the system.
IncidentState [Change_Management] — This script is used as dynamic section to desplay in the layout one of the incident state.
IncidentsCheck-NumberofTotalEntriesErrors [IntegrationsAndIncidentsHealthCheck] — Health Check dynamic section, showing the total number of errors in failed incidents.
IncidentsCheck-PlaybooksFailingCommands [IntegrationsAndIncidentsHealthCheck] — Health Check dynamic section, showing the top ten commands of the failed incidents in a pie chart.
IncidentsCheck-PlaybooksHealthNames [IntegrationsAndIncidentsHealthCheck] — Health Check dynamic section, showing the top ten playbook names of the failed incidents in a bar chart.
IncidentsCheck-Widget-CommandsNames [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard pie graph widget with the top failing incident commands.
IncidentsCheck-Widget-CreationDate [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard line graph widget with the creation date of failing incidents.
IncidentsCheck-Widget-IncidentsErrorsInfo [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard table graph widget with the information about failing incidents.
IncidentsCheck-Widget-NumberFailingIncidents [IntegrationsAndIncidentsHealthCheck] — Data output script for populating dashboard number graph widget with the number of failing incident.
IncidentsCheck-Widget-NumberofErrors [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard number graph widget with the number of entries ID errors.
IncidentsCheck-Widget-PlaybookNames [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard bar graph widget with the top failing playbooks name.
IncidentsCheck-Widget-UnassignedFailingIncidents [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard number graph widget with the number of unassigned failing incidents.
IncreaseIncidentSeverity [CommonScripts] — Optionally increases the incident severity to the new value if it is greater than the existing severity.
IndicatorMaliciousRatioCalculation [CommonScripts] — Return indicators appears in resolved incidents, and resolved incident ids.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
Indicators-type [RDPCacheHunting] — Health Check dynamic section, showing the top ten categories of the failed integrations in a pie chart.
InferWhetherServiceIsDev [CortexAttackSurfaceManagement] — Identify whether the service is a "development" server. Development servers have no external users and run no production workflows. These servers might be named "dev", but they might also be named "qa", "pre-production", "user acceptance testing", or use other non-production terms. This automation uses both public data visible to anyone (`active_classifications` as derived by Xpanse ASM) as well as checking internal data for AI-learned indicators of development systems (`asm_tags` as derived from integrations with non-public systems).
InstancesCheck-FailedCategories [IntegrationsAndIncidentsHealthCheck] — Health Check dynamic section, showing the top ten categories of the failed integrations in a pie chart.
InstancesCheck-NumberofEnabledInstances [IntegrationsAndIncidentsHealthCheck] — Health Check dynamic section, showing the total number of checked integrations.
InstancesCheck-NumberofFailedInstances [IntegrationsAndIncidentsHealthCheck] — Health Check dynamic section, showing the total number of failed integrations.
IntegrationsCheck-Widget-IntegrationsCategory [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard pie graph widget with the failing integrations.
IntegrationsCheck-Widget-IntegrationsErrorsInfo [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard table graph widget with the information about failing integrations.
IntegrationsCheck-Widget-NumberChecked [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard number graph widget with the number of checked integrations.
IntegrationsCheck-Widget-NumberFailingInstances [IntegrationsAndIncidentsHealthCheck] — Data output script for populating the dashboard number graph widget with the number of failing integrations.
IntezerRunScanner [Intezer] — Deprecated. D2 agent is deprecated. No available replacement.
IntezerScanHost [Intezer] — Deprecated. D2 agent is deprecated. No available replacement.
InvertEveryTwoItems [CommunityCommonScripts] — This transformer will invert every two items in an array.
Example:
["A", "B", "C", "D"]
Result:
["B", "A", "D", "C"]
If the total of items in the array is an odd number the last item will be removed
Example:
["A", "B", "C", "D", "E"]
Result:
["B", "A", "D", "C"]
If the item is not an array the output will be same passed object.
InvestigationDetailedSummaryParse [MalwareInvestigationAndResponse] — Parses attacks from context, and shows them according to the MITRE technique they use.
InvestigationDetailedSummaryToTable [MalwareInvestigationAndResponse] — Shows InvestigationDetailedSummaryParse results as a markdown table.
InvestigationSummaryParse [MalwareInvestigationAndResponse] — Retrieves information from previously run reputation commands and aggregates their results.
InvestigationSummaryToTable [MalwareInvestigationAndResponse] — Creates a human readable table from ParseMalware context results.
IqHubLog [Confluera] — Logs detection and progression count with respective links to confluera's IQ-Hub portal
in tabular format.
IsDemistoRestAPIInstanceAvailable [XSOAR-SimpleDevToProd] — Checks if the provided Core/Demisto REST API instance is available for the XSOAR Simple Dev to Prod workflow.
IsDomainInternal [CommonScripts] — The script takes one or more domain names and checks whether they're in the Cortex XSOAR list defined in the *InternalDomainsListName* argument. By default, the *InternalDomainsListName* argument will use the Cortex XSOAR list called "InternalDomains".
The list can be customized by the user. It should contain the organization's internal domain names, separated by new lines. Subdomains are also supported in the list.
The results of the script are tagged with the "Internal_Domain_Check_Results" tag, so they can be displayed in the War Room entry sections in incident layouts.
IsEmailAddressInternal [CommonScripts] — Checks if the email address is part of the internal domains.
IsGreaterThan [CommonScripts] — Checks if one number(float) as bigger than the other(float)
Returns yes: if first > second
Returns no: if first <= second
Returns exception if one of the inputs is not a number
IsIPInRanges [CommonScripts] — Returns yes if the IP is in one of the ranges provided, returns no otherwise.
IsIPPrivate [CommonScripts] — The script takes one or more IP addresses and checks whether they're in the private IP ranges defined in the PrivateIPsListName argument. By default, the PrivateIPsListName argument will use the Cortex XSOAR list called "PrivateIPs".
The list can be modified, and by default uses the ranges defined by the Internet Assigned Numbers Authority (IANA). The following are the default CIDR ranges for private IPv4 addresses:
- 10.0.0.0/8 (range: 10.0.0.0 to 10.255.255.255)
- 172.16.0.0/12 (range: 172.16.0.0 to 172.31.255.255)
- 192.168.0.0/16 (range: 192.168.0.0 to 192.168.255.255)
In addition to ranges, it's also possible to add specific IP addresses to the list. You may also tag IPs or IP ranges by adding a comma after the IP or range, and then adding the tag that you want to tag the corresponding IP indicators with.
IsInCidrRanges [FiltersAndTransformers] — Determines whether an IPv4 or IPv6 address is contained in at least one of the comma-delimited CIDR ranges. Multiple IPv4/IPv6 addresses can be passed comma-delimited and each will be tested. A mix of IPv4 and IPv6 addresses will always return false.
IsIncidentPartOfCampaign [Campaign] — Gets the ID of an incident campaign that is linked to at least one of the given incidents.
IsIntegrationAvailable [CommonScripts] — Returns 'yes' if integration brand is available. Otherwise returns 'no'.
IsInternalDomainName [CommonScripts] — This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain.
IsInternalHostName [CommonScripts] — Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix.
IsListExist [CommonScripts] — Check if list exist in demisto lists.
IsMaliciousIndicatorFound [CommonScripts] — Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.
IsNotInCidrRanges [FiltersAndTransformers] — Checks whether an IPv4 or IPv6 address is not contained in one or more comma-delimited CIDR ranges.
IsPDFFileEncrypted [CommonScripts] — Checks whether the PDF file is encrypted.
IsRFC1918Address [FiltersAndTransformers] — A filter that receives a single IPv4 address string as an input and determines whether it is in the private RFC-1918 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). For more information, see https://en.wikipedia.org/wiki/Private_network
IsTrue [CommonScripts] — Check if a given value is true. Will return 'no' otherwise
IsUrlPartOfDomain [CommonScripts] — Checks if the supplied URLs are in the specified domains.
IsValueInArray [CommonScripts] — Indicates whether a given value is a member of given array
IsolationAssetWrapper [CommonScripts] — This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex XSOAR 6.0.0).
IvantiHeatCloseIncidentExample [IvantiHeat] — This is a sample script that demonstrates how to close an incident in Ivanti Heat. The script generates data of the closed incident in JSON format and writes it to the IvantiHeat.CloseIncidentJSON context path.
IvantiHeatCreateIncidentExample [IvantiHeat] — This is a sample script that demonstrates how to create an incident in Ivanti Heat. The script generates data of the created incident in JSON format and writes it to the IvantiHeat.CreateIncidentJSON context path.
IvantiHeatCreateProblemExample [IvantiHeat] — This is a sample script that demonstrates how to create a problem in Ivanti Heat. The script generates data of the created problem in JSON format and writes it to the IvantiHeat.CreateProblemJSON context path.
JIRAPrintIssue [Jira] — Pretty print JIRA issue into the incident war room.
JSONDiff [CommonScripts] — compares two JSON files and returns their differences, such as added, removed, or changed fields, in a structured format.
JSONFeedApiModule [ApiModules] — Common code that will be appended into each JSON Feed integration when it's deployed.
JSONFileToCSV [CommonScripts] — Script to convert a War Room output JSON File to a CSV file.
JSONtoCSV [CommonScripts] — Convert a JSON War Room output via EntryID to a CSV file.
JiraAddComment [Jira] — Use this script to add a comment with a tag (the "Comment tag to Jira" defined in the instance configuration) as an entry in XSOAR, which will then be mirrored as a comment to a Jira issue. This script should be run within an incident.
JiraChangeStatus [Jira] — This script changes the status field of a Jira incident. It gets the new Jira status of the remote Jira issue and updates the Cortex XSOAR incident status.
JiraCreateIssue-example [Jira] — This script is used to simplify the process of creating a new Issue in Jira.
You can specify custom fields using the `customFields` argument.
JiraListStatus [Jira] — This script lists all possible statuses for a given Jira issue. Works only for Jira v3.
JobCreator [ContentManagement] — Job Creator for the Content Management pack.
JoinIfSingleElementOnly [FiltersAndTransformers] — Return the single element in case the array has only 1 element in it, otherwise return the whole array.
JoinListsOfDicts [SafeBreach] — Deprecated. No available replacement.
Json2HtmlTable [CommunityCommonScripts] — Converts JSON objects to HTML tables.
JsonToTable [FiltersAndTransformers] — Accepts a json object and returns a markdown. Supports clickable links.
JsonUnescape [CommonScripts] — Recursively un-escapes JSON data if escaped JSON is found.
KeylightCreateIssue [Lokpath_Keylight] — Use this script to simplify the process of creating or updating a record in Keylight (v2). You specify custom arguments for which to populate the components. The arguments in this documentation are meant as examples only.
KillProcessWrapper [MalwareInvestigationAndResponse] — A cross-vendor wrapper script that triggers a ‘process kill’ command - i.e executes the proper kill process command according to the vendor: CrowdstrikeFalcon or Cortex XDR. The script will only fail when the kill process action fails for both vendors.
LanguageDetect [CommonScripts] — Language detection based on Google's language-detection.
LastArrayElement [FiltersAndTransformers] — Returns the last element of an array. If the value passed is not an array, it returns the original value that was passed.
LessThanPercentage [CommonScripts] — Checks if one percentage is less than another
Returns less: if firstPercentage < secondPercentage
Returns more: if firstPercentage >= secondPercentage
Returns exception if one of the inputs is not a float
LinkIncidentsButton [CommonScripts] — Incident action button script to link or unlink Incidents from an Incident.
LinkIncidentsWithRetry [CommonScripts] — Use this script to avoid DB version errors when simultaneously running multiple linked incidents.
LinkToPhishingCampaign [Phishing] — Links a Phishing incident to its related Phishing Campaign incident.
ListCreator [ContentManagement] — List Creator for the Content Management pack.
ListDeviceEvents [GoogleChronicleBackstory] — List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.
ListGroupBy [SafeBreach] — Deprecated. No available replacement.
ListInstalledContentPacks [XSOARContentUpdateNotifications] — This script will show all installed content packs and whether they have an update.
ListUsedDockerImages [CommonScripts] — List all Docker images that are in use by the installed integrations and automations.
LoadJSON [CommonScripts] — Loads a json from string input, and returns a json object result.
LoadJSONFileToContext [CommonScripts] — Loads a JSON file from the war room to context.
LookupCSV [CommonScripts] — Parses a CSV and looks for a specific value in a specific column, returning a dict of the entire matching row. If no column value is specified, the entire CSV is read into the context.
LowerCidrNumAddresses [FiltersAndTransformers] — Check if number of availble addresses in IPv4 CIDR is lower than given number.
MCPApiModule [ApiModules] — Common Model Context Protocol (MCP) code that will be appended into each MCP integration when it's deployed.
MITREIndicatorsByOpenIncidentsV2 [FeedMitreAttackv2] — This is a widget script returning MITRE indicators information for top indicators shown in incidents.
MITRENameByID_Formatter [CommonScripts] — Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).
MS365DefenderAddComment [Microsoft365Defender] — Use this script to add a comment to a Microsoft 365 Defender incident. To be run within the incident.
MSEScoreWidget [SuspiciousDomainHunting] — This dynamic automation parses the MSE results and presents it in the layout in color according to its score.
MakePair [FiltersAndTransformers] — This transformer will create a list of dictionary by aggregating elements from two arrays.
The one is given by `value` (with `array1_key`), another is given by `array2` (with `array2_key`).
MaliciousRatioReputation [CommonScripts] — Set indicator reputation to "suspicious" when malicious ratio is above threshold.
Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.
ManageOOOusers [ShiftManagement] — Adds or removes an analyst from the out-of-office list in XSOAR. When used with the AssignAnalystToIncidentOOO automation, prevents incidents from being assigned to an analyst who is out of office.
MapPattern [FiltersAndTransformers] — This transformer will take in a value and transform it based on multiple condition expressions (wildcard, regex, etc) defined in a JSON dictionary structure. The key:value pair of the JSON dictionary should be:
"condition expression": "desired outcome"
For example:
{
".*match 1.*": "Dest Val1",
".*match 2.*": "Dest Val2",
".*match 3(.*)": "\\1",
"*match 4*": {
"algorithm": "wildcard",
"output": "Dest Val4"
}
}
The transformer will return the value matched to a pattern following to the priority.
When unmatched or the input value is structured (dict or list), it will simply return the input value.
MapRangeValues [FiltersAndTransformers] — This script converts an input value into another value using two lists. The input value or range is searched in the first list (map_from).
If it exists, the value at the same index from the second list (map_to) is returned. If there is no match, the original value is returned.
This script supports mapping from either ranges of float numbers or text strings.
Example 1:
map_from = "1,2,3,4"
map_to = "4,3,2,1"
value = 3
Output is "2"
Example 2:
map_from = "1-3,4"
map_to = "5,1"
value = 3
Output is "5".
MapRegex [CommunityCommonScripts] — This transformer will take in a value and transform it based on multiple regular expressions defined in a JSON dictionary structure. The key:value pair of the JSON dictionary should be:
"desired outcome": "regex to match"
For example:
{
"Match 1": ".*match 1.*",
"Match 2": ".*match 2.*",
"Catch all": ".*"
}
The transformer will match in order of dictionary entries.
MapValues [CommonScripts] — Map the given values to the translated values. If given values: a,b,c, and translated: 1,2,3, then the input will return 1.
MapValuesTransformer [FiltersAndTransformers] — This script converts the input value into another value using two lists. The input value is searched in the first list (input_values).
If it exists, the value from the second list (mapped_values) at the same index is retutrned. If there is no match, the original value is returned.
If the original input is a dictionary, then the script will look for a "stringified" version of the key/:/value pair in the input_values and then map the result in the output_values into the original "value".
Example 1:
input_values = "1,2,3,4"
mapper_values = "4,3,2,1"
value = 3
Output would be "2"
Example 2:
input_values ="firstkey: datahere,secondkey: datathere"
mapper_values = "datathere,datahere"
value(dict)= {
"firstkey": "datahere"
}
Output would be:
{
"firstkey": "datathere"
}
The reason for matching the key AND value pair in a dictionary is to allow the mappig of values that have a specific key name. In most cases, dictionaries will continan key-value pairs in which the values are the same. You might want to change the value of KeyA, but not the value of KeyB. This method gives control over which key is changed.
When the input is a dict, str , int, or list, the output is ALWAYS returned as a string.
MarkAsEvidenceBySearch [UpdateEntriesBySearch] — Search entries in the war room for the pattern text, and mark them as evidence.
MarkAsEvidenceByTag [CommonScripts] — Mark entries as evidence if they are tagged with given tag.
MarkAsNoteBySearch [UpdateEntriesBySearch] — Search entries in the war room for the pattern text, and mark as note to the entries found.
MarkAsNoteByTag [CommonScripts] — Mark entries as notes if they are tagged with given tag.
MarkRelatedIncidents [CommonScripts] — Marks given incidents as related to current incident.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
MarkdownToHTML [CommunityCommonScripts] — Converts Markdown to HTML.
MatchIPinCIDRIndicators [ExpanseV2] — Deprecated. No available replacement. > Match provided IP address in all the Indicators of type CIDR with the provided tags (longest match).
MatchRegex [CommonScripts] — Deprecated. Use the **MatchRegexV2** script instead.
MatchRegexV2 [CommonScripts] — Extracts regex data from the provided text. The script support groups and looping.
MathUtil [CommonScripts] — Script will run the provided mathematical action on 2 provided values and produce a result.
The result can be stored on the context using the contextKey argument
MattermostAskUser [Mattermost] — Ask a user a question on Mattermost and expect a response. The response can also close a task (might be conditional) in a playbook.
MaxList [CommunityCommonScripts] — Gets the maximum value from list
e.g. ["25", "10", "25"] => "25".
MergeDictArray [FiltersAndTransformers] — Each entry in an array is merged into the existing array if the keyed-value matches.
MicrosoftApiModule [ApiModules] — Common Microsoft code that will be appended into each Microsoft integration when it's deployed
MicrosoftAtpEndpoint [MicrosoftDefenderAdvancedThreatProtection] — A polling wrapper script; retrieves machines that have communicated with Microsoft Defender for Endpoint cloud. At least one of the following arguments is required: IP, hostname, or ID. Otherwise, an error appears.
MicrosoftAtpIsolateMachine [MicrosoftDefenderAdvancedThreatProtection] — A polling wrapper script; isolates a machine from accessing external networks.
MicrosoftAtpScIndicatorCreate [MicrosoftDefenderAdvancedThreatProtection] — A polling wrapper script; creates a new indicator in Microsoft Defender for Endpoint.
MicrosoftAtpStopAndQuarantineFile [MicrosoftDefenderAdvancedThreatProtection] — A polling wrapper script; Stop the execution of a file on a machine and delete it.
MicrosoftAtpUnisolateMachine [MicrosoftDefenderAdvancedThreatProtection] — A polling wrapper script; isolates a machine from accessing external networks.
MicrosoftAzureStorageApiModule [ApiModules] — Common Microsoft Azure Storage code that will be appended into each Microsoft Azure Storage integration.
MicrosoftGraphFilesApiModule [ApiModules] — Common Microsoft Graph Files code that will be appended into the Microsoft Graph Files integrations when it's deployed.
MicrosoftGraphMailApiModule [ApiModules] — Common Microsoft Graph Mail code that will be appended into the Microsoft Graph Mail integrations when it's deployed.
MicrosoftGraphTeamsApiModule [ApiModules] — Provides common Microsoft Graph Teams code that is appended into Cortex integrations during deployment.
MicrosoftSentinelSetOwner [AzureSentinel] — This script can be run from the War Room or used by a layout to set the Owner field in Microsoft Sentinel.
MicrosoftSentinelSubmitNewComment [AzureSentinel] — Use this script to add a comment which will then be mirrored as a comment to a Sentinal event. This script should be run within an incident.
MicrosoftTeamsAsk [MicrosoftTeams] — Send a team member or channel a question with predefined response options on Microsoft Teams. The response can be used to close a task (might be conditional) in a playbook.
MimecastFindEmail [Mimecast] — Find an email across all mailboxes, and return the list of mailboxes where the email was found, as well as Yes if the mail was found anywhere or No otherwise.
MinList [CommunityCommonScripts] — Gets the minimum value from list
e.g. ["25", "10", "25"] => "10".
MissingElements [CommunityCommonScripts] — Returns the list of missing elements from an input list of integers.
e.g. [12,14,16] -> [13,15].
ModifyDateTime [FiltersAndTransformers] — Takes a date or time input and adds or subtracts a determined amount of time. Returns a string in date or time in ISO Format.
MsGraphMailDeleteEmail [MicrosoftGraphMail] — A polling wrapper script; deletes an email.
MyToDoTasksWidget [CommonWidgets] — A script that creates a table of all the ToDo tasks assigned to the current user.
NCSCCalculateQuestionsScore [NCSCCyberAsssessmentFramework] — This script calculates the score based on the question and answer responses.
NCSCFieldProtection [NCSCCyberAsssessmentFramework] — This script protects the fields associated with the assessment from accidental modification.
NCSCQuestionPopulate [NCSCCyberAsssessmentFramework] — Populate a list named "NCSC CAF Assessment" with a list of the NCSC Questions.
NCSCReportDetails [NCSCCyberAsssessmentFramework] — This script generates the report details used in the final report.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
NCSCReportDetails_A [NCSCCyberAsssessmentFramework] — This script generates the report details for the individual CAF Section.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
NCSCReportDetails_B [NCSCCyberAsssessmentFramework] — This script generates the report details for the individual CAF Section.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
NCSCReportDetails_C [NCSCCyberAsssessmentFramework] — This script generates the report details for the individual CAF Section.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
NCSCReportDetails_D [NCSCCyberAsssessmentFramework] — This script generates the report details for the individual CAF Section.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
NCSCReportOverview [NCSCCyberAsssessmentFramework] — This script generates the report details for the individual CAF Section.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
NGINXApiModule [ApiModules] — Common NGINX code that will be appended into each NGINX based integration when it's deployed.
NetwitnessSAAddEventsToIncident [RsaNetwitnessSecurityAnalytics] — This command will add new events to an existing NetWitness SA incident.
NetwitnessSACreateIncident [RsaNetwitnessSecurityAnalytics] — Create an incident inside NetWitness SA from a set of NetWitness events.
NetwitnessSAGetAvailableAssignees [RsaNetwitnessSecurityAnalytics] — Returns the available NetWitness SA users to be assigned to incidents.
NetwitnessSAGetComponents [RsaNetwitnessSecurityAnalytics] — Get a list of components in the NetWitness architecture.
NetwitnessSAGetEvents [RsaNetwitnessSecurityAnalytics] — Returns all the RSA NetWitness SA events in the defined time range.
NetwitnessSAListIncidents [RsaNetwitnessSecurityAnalytics] — List NetWitness SA incidents. Filtering and sorting the list is also supported (see optional arguments).
NexposeEmailParser [Rapid7_Nexpose] — Parses nexpose report into a clear table that contain risk score and vulnerability count for each server,
And creates a new incident for each server.
NexposeEmailParserForVuln [Rapid7_Nexpose] — Parses nexpose report into a clear table that contain risk score and vulnerability count for each server,
And creates a new incident for each server.
NexposeVulnExtractor [Rapid7_Nexpose] — Parse a specific server nexpose response in to a table of vulnerabilities.
NotInContextVerification [CommonScripts] — Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution.
NumberOfPhishingAttemptPerUser [CommonScripts] — Shows a bar chart of the number of incident the 'To' and 'From' email addresses.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
OSQueryBasicQuery [OSQuery] — Returns the results from a basic OSQuery query on a remote Linux machine.
For more information read documentation at https://osquery.readthedocs.io/
OSQueryLoggedInUsers [OSQuery] — Deprecated. Use OSQueryBasicQuery with query='select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, processes p where liu.pid = p.pid;' instead.
OSQueryOpenSockets [OSQuery] — Deprecated. Use OSQueryBasicQuery with query='select distinct pid, family, protocol, local_address, local_port, remote_address, remote_port, path from process_open_sockets where path `<>` '' or remote_address `<>` '';' instead.
OSQueryProcesses [OSQuery] — Deprecated. Use OSQueryBasicQuery with query='select * from processes' instead.
OSQueryUsers [OSQuery] — Deprecated. Use OSQueryBasicQuery with query='select * from users;' instead.
OktaApiModule [ApiModules] — Common Okta code for all Okta-related integrations.
Oletools [Oletools] — This is an automation to run oletools malware analysis for office files. Oletools is a tool for analyzing Microsoft OLE2 files, such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics, and debugging. This automation allows performing some basic oletools commands from Cortex XSOAR. Note that oletools is open source code and is subject to change.
OnboardingCleanup [OnboardingIntegration] — Cleanup the incidents and indicators created by OnboardingIntegration
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
OnionURLReputation [CommonScripts] — This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.
Osxcollector [OSXCollector] — Execute osxcollector on machine, can run ONLY on OSX
OutOfOfficeListCleanup [ShiftManagement] — Removes any users from the out-of-office list whose 'off until day' is in the past.
PAN-OS-AnalyzeRuleHitCounts [PAN-OS] — Processes the context output from !pan-os-get-rulehitcounts and returns data about unused local rules, unused rules from Panorama, and rules from Panorama that have hits on some firewalls but not all.
PAN-OS-GetAvailablePANOSSoftware [PAN-OS] — This script is a wrapper for the 'pano-os-platform-get-available-software' command, adding options to return only images newer than is currently installed to minimize amount of context data generated.
PAN-OS-GetDeviceDiskSpace [PAN-OS] — Fetches disk space info from the target device and returns all information or a subset as specified in command arguments.
PAN-OS_Security_Advisories_Enrichment [PAN-OS] — This script enriches CVEs published by Palo Alto Networks with detailed vulnerability information from the official Palo Alto Networks Security Advisories website https://security.paloaltonetworks.com.
PANOSQueryLogs [PAN-OS] — A polling wrapper script; This script searches Palo Alto Networks firewall logs across eight different log types (threat, traffic, wildfire, URL, data, correlation, system, and decryption). It provides flexible filtering capabilities including IP addresses, time ranges, network zones, rules, ports, URLs, file hashes, and custom query strings, with configurable result limits up to 5,000 logs. This tool enables security teams to efficiently investigate network activity, analyze traffic patterns, and perform forensic analysis across their Panorama and Firewall infrastructure through automated log retrieval. This script depends on the Panorama integration and can be executed against either a Firewall device or a Panorama device, depending on the configured integration instance.
PANOStoCortexDataLakeMonitoring [PANOStoCDLMonitoring] — Verify that all firewalls successfully pushed logs to the Cortex Data Lake for the last 12 hours. It's an easy way to do monitoring of the FW connection to CDL.
You can use either a manual list of FW serials or a Panorama integration to get the list of equipment to monitor.
PCComputeContainerComplianceIssuesButton [PrismaCloudCompute] — This script runs the "prisma-cloud-compute-container-scan-results-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details.
Returns the following fields for each compliance ID:
- Compliance ID
- Cause
- Severity
- Title
- Description.
PCComputeHostComplianceIssuesButton [PrismaCloudCompute] — This script runs the "prisma-cloud-compute-hosts-scan-list" command for a specific hostname and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details.
Returns the following fields for each compliance ID:
- Compliance ID
- Cause
- Severity
- Title
- Description.
PCComputeImageComplianceIssuesButton [PrismaCloudCompute] — This script runs the "prisma-cloud-compute-images-scan-list" command for a specific container ID and returns details about its compliance issues, if found. If any compliance issues found, it will create a new tab in the layout called "Detailed Compliance Issues" showing the issues details.
Returns the following fields for each compliance ID:
- Compliance ID
- Cause
- Severity
- Title
- Description.
PDFUnlocker [CommonScripts] — Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF.
PFXAnalyzer [CommonScripts] — This script is designed to analyze a PFX (Personal Information Exchange) file for various suspicious or noteworthy characteristics from a security perspective.
PHash [CommunityCommonScripts] — Script to create a perceptual hash of an image (or file) stored in the incident. Wrapps https://pypi.org/project/ImageHash/
PTEnrich [PassiveTotal] — Deprecated. No available replacement. Enrich the given IP or domain with metadata, malware, osint.
PadZeros [FiltersAndTransformers] — Adds zeros (0) to the beginning of the string, until the string reaches the specified length.
PagerDutyAlertOnIncident [PagerDuty] — Send incident details to pagerduty (useful to include in playbooks).
PagerDutyAssignOnCallUser [PagerDuty] — By default assigns the first on-call user to an investigation (all incidents in the investigation will be owned by the on call user).
PanoramaSecurityPolicyMatchWrapper [PAN-OS] — A wrapper script for the panorama-security-policy-match command that receives multiple values for the source, destination, and destination port arguments and performs the policy match for each combination of the inputs.
PanwIndicatorCreateQueries [PANWComprehensiveInvestigation] — The script accepts indicators as input and creates an indicator query in the relevant Palo Alto Networks products.
ParseCSV [CommonScripts] — This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context.
ParseEmailFiles [CommonScripts] — Deprecated. Use ParseEmailFilesV2 instead." Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook.
ParseEmailFilesV2 [CommonScripts] — Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. This script is based on the parse-emails XSOAR python package, check the script documentation for more info.
ParseExcel [CommonScripts] — The automation takes Excel file (entryID) as an input and parses its content to the war room and context.
ParseHTMLIndicators [CommonScripts] — This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
ParseHTMLTables [FiltersAndTransformers] — Find tables inside HTML and extract the contents into objects using the following logic:
- If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value
- If table has a header row, create a table of objects where attribute names are the headers
- If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3...
ParseJSON [FiltersAndTransformers] — Parse a given JSON string "value" to a representative object. Example: '{"a": "value"}' => {"a": "value"}.
ParseWordDoc [CommonScripts] — Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents.
ParseYAML [CommonScripts] — Parses a YAML string into context.
PcapConvert [PcapAnalysis] — Convert packet data to the standard pcap. Currently it only supports CDL(NGFW) pcap from which to convert.
PcapExtractStreams [PcapAnalysis] — Extract payloads of each stream from a pcap.
The payloads will be retrieved with an array of dictionaries of these keys:
- protocol
- client_ip
- client_port
- server_ip
- server_port
- stream_size
- stream_text
- stream_base64
- outgoing_size
- outgoing_text
- outgoing_base64
- incoming_size
- incoming_text
- incoming_base64.
PcapFileExtractStreams [PcapAnalysis] — Extract payloads of each stream from a pcap file.
PcapFileExtractor [PcapAnalysis] — This automation extracts all possible files from a PCAP file.
PcapHTTPExtractor [CommonScripts] — Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.
PcapMinerV2 [PcapAnalysis] — PcapMIner V2 allows to parse PCAP files by displaying the all of the relevant data within including ip addresses, ports, flows, specific protocol breakdown, searching by regex, decrypting encrypted traffic and more.
This automation takes about a minute to process 20,000 packets (which is approximately 10MB). If you want to mine large files you can either:
a) Use the `pcap_filter` parameter to filter your PCAP file and thus make is smaller.
b) Copy the automation and change the `default timeout` parameter to match your needs.
PenfieldAssign [PenfieldAI] — PenfieldAssign will use the Penfield.AI integration's penfield-get-assignee command to determine who an incident should be assigned to, then print the selected analyst to the War Room and overwrite the owner property.
PenteraDynamicTable [Pcysys] — Renders a Markdown Table from penteraoperationdetails field in Pentera Insight incidents
PenteraOperationToIncident [Pcysys] — Groups Pentera Full Actions Reports by Operation Type to generate an output usable in creating incidents
PerformActionOnCampaignIncidents [Campaign] — Perform user actions such as link, close, etc., on selected incidents from a campaign.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
PhishLabsPopulateIndicators [PhishLabs] — Populate indicators by the PhishLabs IOC global feed.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
Ping [CommonScripts] — Pings an IP or url address, to verify it's up. Note - On Cortex XSOAR 8 and Cortex XSIAM, the script can run only on a custom engine.
PreProcessAsimilyDedup [Asimily_Insight] — Asimily Preprocessing Rule for Deduplication of incoming incident. The script will be used for creating Pre-Process Rules for Incidents to avoid creating duplicate incidents. Comparison is based on incident type and dbotMirrorId.
PreProcessImage [CommonScripts] — This script pre-processes (resizes, sharpens, and grayscales) an image file from context, given an entry_id.
PreprocessEmail [EmailCommunication] — Preprocessing script for email communication layout.
This script checks if the incoming email contains an Incident ID to link the mail to an existing incident, and tags the email as "email-thread".
This script runs with elevated permissions.
Cortex XSOAR recommends using the built-in RBAC functionality to limit access to only those users requiring access to this script.
For more information about the preprocessing rules, refer to: https://demisto.developers.paloaltonetworks.com/docs/incidents/incident-pre-processing
PrettyPrint [CommonScripts] — Pretty-print data using Python's pprint library. This is useful for seeing the structure of incident and context data. Here's how to use it:
!PrettyPrint value=${incident}.
Print [CommonScripts] — Prints text to war room (Markdown supported)
PrintContext [CommonScripts] — Pretty-print the contents of the playbook context.
PrintErrorEntry [CommonScripts] — Prints an error entry with a given message.
PrintRaw [CommonScripts] — Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression.
PrintToAlert [CommonScripts] — Prints a value to the specified alert's war-room. The alert must be in status "Under Investigation".
PrintToIncident [CommonScripts] — Prints a value to the specified incident's war-room.
PrintToParentIncident [CommonScripts] — Prints a value to the parent incident's war-room of the current alert.
PrismaCloudAttribution [PrismaCloud] — Recursively extracts specified fields from provided list of assets for Prisma Cloud attribution use case.
PrismaCloudComputeComplianceTable [PrismaCloudCompute] — Iterate over EnrichedComplianceIssue information in the context data and add the important keys to a table under PrismaCloudCompute.ComplianceTable or a provided grid id.
PrismaCloudLocalTrustedImagesListUpdate [PrismaCloudCompute] — Takes the results of "prisma-cloud-compute-images-scan-list" and "prisma-cloud-ci-scan-results-list" commands and creates or updates a list of trusted images which can be used for updating the "Trusted Images" list in Prisma Cloud, using the PrismaCloudRemoteTrustedImagesListUpdate automation.
PrismaCloudRemoteTrustedImagesListUpdate [PrismaCloudCompute] — Gets the existing "Trusted Images" results from Prisma Cloud Compute and updates the relevant trust group with the images stored in the given internal list.
ProductJoin [FiltersAndTransformers] — Returns the product of two lists, joined by a separator, as a list of strings.
ProofpointDecodeURL [DeprecatedContent] — Deprecated. Use UnEscapeURLs instead. Decode ProofPoint URLs to get the actual URLs.
ProofpointTAPMostAttackedUsers [ProofpointTAP] — Exports a list of Proofpoint TAP most attacked users to the Cortex XSOAR widget.
ProofpointTapTopClickers [ProofpointTAP] — Exports a list of Proofpoint TAP top clickers to the Cortex XSOAR widget.
ProvidesCommand [CommonScripts] — Finds which integrations implement a specific Demisto command. The results will be returned as comma-separated values (CSV). The "Core REST API" integration must first be enabled.
QRadarClassifier [QRadar] — Deprecated. No available replacement. This script Classifies QRadar incidents.\nThe 'QRADAR_CATEGORIES' dictionary translate QRadar 'High level Categories' to its 'Demisto Types' counterpart.\n\nFor custom categories, use the 'customCategories' argument.\nThe offense high level category will be put to context.
QRadarFetchedEventsSum [QRadar] — This display the amount of fetched events vs the total amount of events in the offense.
QRadarFullSearch [QRadar] — Deprecated. No available replacement. This Script runs a QRadar query and return its results to the war-room.
QRadarGetCorrelationLogs [QRadar] — Deprecated. Use the **QRadarCorrelationLog** playbook instead. Return the QRadar Correlation logs if exist
QRadarGetOffenseCorrelations [QRadar] — Deprecated. Use the QradarGetOffenseCorrlations_v2 Playbook instead. Return the QRadar offense correlations if exist in logs.
QRadarMagnitude [QRadar] — This enables to color the field according to the magnitude. The scale is
1-3 green
4-7 yellow
8-10 red.
QRadarPrintAssets [QRadar] — This script prints the assets fetched from the offense in a table format.
QRadarPrintEvents [QRadar] — This script prints the events fetched from the offense in a table format.
QualysCreateIncidentFromReport [qualys] — Create incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID).
Duplicate incidents are not created for the same asset ID and QID.
RCSScan [CortexAttackSurfaceManagement] — This script starts an RCS scan and sets the scan ID in context.
RandomElementFromList [CommunityCommonScripts] — randomly select elements from a list in Python.
RandomPhotoNasa [CommunityCommonScripts] — This automation script will pull a random image from https://images.nasa.gov based on the search parameter provided. If the script is used within a widget, it will output an image in markdown format. If it is used anywhere else it will output an image in markdown format and also context data.
RankRemediationOwners [CortexExposureManagement] — This script determines the most likely remediation owners from those surfaced by other enrichments.
RankServiceOwners [CortexAttackSurfaceManagement] — Recommend most likely service owners from those surfaced by Cortex ASM Enrichment.
RansomwareDataEncryptionStatus [Ransomware] — A Widget script - checks for the data encryption status in post ransomware investigation playbook and layout.
RansomwareHostWidget [Ransomware] — Entry widget that returns the number of affectefd hosts in a Post Intrusion Ransomware incident.
RapidBreachResponse-TotalTasksCount-Widget [MajorBreachesInvestigationandResponse] — Rapid Breach Response dynamic section, will show the updated number of tasks to complete.
ReadFile [CommonScripts] — Load the contents of a file into context.
ReadNetstatFile [CrowdStrikeFalcon] — Load and return the processes file (generated from the cs-falcon-rtr-list-network-stats command) content.
ReadNetstatFileWrapper [MalwareInvestigationAndResponse] — This Automation is a wrapper -
If the CrowdStrike key is present in context, ReadNetstatFile will be executed and displayed.
Else, 'No data on Netstat found' will be displayed.
ReadPDFFileV2 [CommonScripts] — Load a PDF file's content and metadata into context. Supports extraction of hashes, urls, and emails when available.
ReadProcessFileWrapper [MalwareInvestigationAndResponse] — This Automation is a wrapper -
If PaloAltoNetworksXDR is in context - ReadProcessesFileXDR will be executed and displayed.
if CrowdStrike is in context - ReadProcessesFile will be executed and displayed.
else 'No data on Process List found' will be displayed.
ReadProcessesFile [CrowdStrikeFalcon] — Load and return the processes file (generated from the cs-falcon-rtr-list-processes command) content.
ReadProcessesFileXDR [MalwareInvestigationAndResponse] — Return a process list from the XDRIR integration.
ReadQRCode [CommonScripts] — Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code.
RegProbeBasic [D2] — Deprecated. No available replacement.
RegexExpand [FiltersAndTransformers] — Extract the strings matched to the patterns by doing backslash substitution on the template string.
This transformer allow to input multiple regex patterns and multiple match targets, and those can be given in the input value and the argument parameters.
RegexExtractAll [FiltersAndTransformers] — Extraction of all matches from a specified regular expression pattern from a provided string. Returns an array of results. This differs from RegexGroups in several ways:
* It returns all matches of the specified pattern, not just specific groups. This is useful for extracting things using a pattern where the content of the source string is indeterminate, such as extracting all email addresses.
* Some "convenience" arguments have been added to enhance usability: multi-line, ignore_case, period_matches_newline
* Added a new argument, "error_if_no_match". The script will not ordinarily throw an error if a match is not found but if not using as a transformer within a playbook, it may, in certain limited circumstances, be desirable to throw an error if the expression doesn't match.
* It uses the 'regex' library, which supports more some more advanced regex functionality than the standard 're' library. For more info, see https://pypi.org/project/regex/.
RegexGroups [FiltersAndTransformers] — Extraction of elements which are contained in all the subgroups of the match to the pattern.
For example, extracting from the string "The quick brown fox" the object `{"article":"The","noun":quick"}`
(See arguments descriptions for more details).
RegexReplace [FiltersAndTransformers] — Format patterns matched with regex. If the regex does not match any pattern, the original value is returned.
Example 1:
value: user=john
regex: user=(.*)
output_format: name=\1
-> output value: name=john
Example 2:
value: xxx=yyy
regex: user=(.*)
output_format: name=\1
-> output value: xxx=yyy.
RegistryParse [WindowsForensics] — This command uses the Registry Parse automation to extract critical forensics data from a registry file. The essential values are specified by the argument.
RemediationPathRuleEvaluation [CortexAttackSurfaceManagement] — For a given alert and remediation path rules that are defined for that alert's attack surface rule, this script takes each remediation path rule and looks at the rule criteria to see if the rule matches for the given alert. If multiple rules match, it will return the most recently created rule. This assumes that the rules passed in are filtered to correlate with the alert's attack surface rule.
RemoteExec [CommonScripts] — Execute a command on a remote machine (without installing a D2 agent)
RemoveEmpty [FiltersAndTransformers] — Remove empty items, entries or nodes from the array.
RemoveEmptyEvidence [CommunityCommonScripts] — The automation removes evidence based on a query performed on the evidence content,
if the provided string is found within the evidence- it will be removed.
RemoveFileWrapper [Malware] — This script allows removing specified files using Cortex XDR, CrowdStrike and Microsoft Defender (Advanced Threat Protection).
RemoveKeyFromList [CommonScripts] — Removes a key in key/value store backed by an XSOAR list.
RemoveMatches [FiltersAndTransformers] — Removes items from the given list of values if they match any of the patterns in the provided `filters`.
If the match_exact argument is 'yes', direct string compare is used, otherwise the comparison is done using regex.
RemoveNullBytes [FiltersAndTransformers] — Removes null bytes from string.
ReplaceMatchGroup [CommonScripts] — Returns a string with all matches of a regex pattern groups replaced by a replacement.
RepopulateFiles [CommonScripts] — After running DeleteContext, this script can repopulate all the file entries in the ${File} context key.
ResolveGemAlert [Gem] — Post Processing Script that will resolve the relevant Threat in the Gem platform.
ResolveShortenedURL [CommonScripts] — This script resolves the original URL from a given shortened URL and places the resolved URL in the playbook context and output.
RestartFailedTasks [IntegrationsAndIncidentsHealthCheck] — Use this Script to re-run failed tasks. Run in the same incident after running `GetFailedTasks` for restarting all of the failed tasks or some of them.
RetrievePlaybookDependencies [CommunityCommonScripts] — Retrieves all Playbook (and Sub-Playbook) Names, Integrations, Automation Scripts, Commands not using-brand, and lists for a provided Playbook name. Also accepts inputs for incident types, layouts, incident fields, indicator fields, jobs, mappers, and pre-process rules connected to the parent playbook. Results can be output as an HTML or Markdown list.
RetrievePlaybooksAndIntegrations [CommunityCommonScripts] — Deprecated. Use RetrievePlaybookDependencies instead. Retrieves all Playbook (and Sub-Playbook) Names and Integrations for a provided Playbook name
ReverseList [FiltersAndTransformers] — Reverse a list
e.g. ["Mars", "Jupiter", "Saturn"] => ["Saturn", "Jupiter", "Mars"]
This is an example for entire-list transformer - it operates the argument as a list (note the "entirelist" tag).
RiskIQDigitalFootprintAssetDetailsWidgetScript [RiskIQDigitalFootprint] — Shows the detailed information of an asset identified as a "RiskIQAsset" type of indicator in the layout of the indicator.
RiskIQPassiveTotalComponentsScript [PassiveTotal] — Enhancement script to enrich PassiveTotal components for Domain and IP type of indicators.
RiskIQPassiveTotalHostPairParentsScript [PassiveTotal] — Enhancement script to enrich PassiveTotal host pair of parents for Domain and IP type of indicators.
RiskIQPassiveTotalSSLScript [PassiveTotal] — Enhancement script to enrich SSL information for Email, File SHA-1 and RiskIQSerialNumber type of indicators.
RiskIQPassiveTotalSSLWidgetScript [PassiveTotal] — Set widgets to custom layout in Email, RiskIQSerialNumber and File SHA-1 type of indicators.
RiskIQPassiveTotalTrackersScript [PassiveTotal] — Enhancement script to enrich web trackers information for Domain and IP type of indicators.
RiskSenseGetRansomewareCVEScript [RiskSense] — This script is a helper script of Ransomware Exposure - RiskSense playbook and retrieve information of cves and trending cves from host finding details.
RunCPPhishingCampaign [CheckPointHEC] — Search other emails by sender and/or subject and quarantine.
RunDockerCommand [CommonScripts] — This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container.
We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context.
RunPollingCommand [CommonScripts] — Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SCPPullFiles [CommonScripts] — Take a list of devices and pull a specific file (given by path) from each using SCP.
SEPCheckOutdatedEndpoints [SymantecEndpointProtection] — Check if any endpoints are using an AV definition that is not the latest version.
SOCFWPackManager [SocFrameworkManager] — The SOC Framework bootloader for Cortex XSIAM. Lists the SOC Framework pack
catalog with the installed version and update status of each pack, installs
and configures packs from xsoar_config.json, re-runs configuration only, and
diagnoses the platform endpoints the install path depends on. Also includes
sync-tags, a backward-compatible action for older SOC Framework deployments
still using the value_tags lookup; modern versions use the
SOCActionTimeMap_V3 list and do not require it.
SSDeepReputation [CommonScripts] — Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system.
SSDeepSimilarity [CommonScripts] — This script finds similar files that can be related to each other by fuzzy hash (SSDeep).
SSIMScoreWidget [SuspiciousDomainHunting] — This dynamic automation parses the SSIM results and presents it in the layout in color according to its score.
SSLVerifier [CommunityCommonScripts] — Use this automation to check for validity of your SSL certificate and get the time until expiration.
SSLVerifierV2 [SSLCertificates] — Use this automation to check for validity of your SSL certificate and get the time until expiration.
SSLVerifierV2_GenerateEmailBody [SSLCertificates] — Generates the HTML needed for a formatted email to be sent using the outputs of !SSLVerifierV2, as part of the SSLVerifierV2 content pack.
SSLVerifierV2_ParseOutput [SSLCertificates] — Parses the output from the !SSLVerifierV2 automation into a markdown table and separate context key .
This automation uses the SSLVerifierV2 key by default, but a custom context key can be specified in the event extend-context is used with the SSLVerifierV2 automation.
Option to specify whether to output certificates with an expiring, warning, or good status (or all at once).
Option to specify whether or not to output the generated tables to the war room.
STA-FetchListContent [SafeNet_Trusted_Access] — This script will get the Unusual Activity Group from "sta_unusual_activity_group" List.
STA-PostProcessing [SafeNet_Trusted_Access] — Post processing script to remove the user from the Unusual Activity Group on Close Form.
SalesforceAskUser [Salesforce] — Ask a user a question via Salesforce Chatter and process the reply directly into the investigation.
SalesforceCaseStatus [SalesforceV2] — Populates the value of the Salesforce status field and displays it in a layout widget.
SaneDocReports [Base] — Parse Sane-json-reports and export them as docx files (used internally).
SanePdfReports [Base] — Parse Sane-json-reports and export them as pdf files (used internally).
SbDownload [Sandblast] — Deprecated. Use Check Point Threat Emulation (SandBlast) instead. Query, upload and download data using Check Point Sandblast on cloud.
SbQuery [Sandblast] — Deprecated. Use Check Point Threat Emulation (SandBlast) instead. Query, upload and download data using Check Point Sandblast on cloud.
SbQuota [Sandblast] — Deprecated. Use Check Point Threat Emulation (SandBlast) instead. Query, upload and download data using Check Point Sandblast on cloud.
SbUpload [Sandblast] — Deprecated. Use Check Point Threat Emulation (SandBlast) instead. Query, upload and download data using Check Point Sandblast on cloud.
ScheduleCommand [CommonScripts] — Schedule a command to run inside the war room at a future time (once or reoccurring)
ScheduleGenericPolling [CommonScripts] — Called by the GenericPolling playbook, schedules the polling task.
SearchCases [CommonScripts] — Retrieves cases based on the provided filters.
SearchIncidentsSummary [CommonScripts] — Searches Cortex XSOAR Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument.
Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument.
This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient.
SearchIncidentsV2 [CommonScripts] — Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
SearchIndicator [CommonScripts] — Searches Cortex XSOAR Indicators.
Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.
You can add additional fields from the indicators using the add_field_to_context argument.
SearchIndicatorAgentix [CommonScripts] — This script searches indicators by specified fields.
SearchIndicatorInEvents [Core] — Searches for a specific indicator in the tenant's event and log data, and extracts the logs the indicator appears in.
SearchIndicatorRelationships [Base] — This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
SearchIndicatorRelationshipsAgentix [Base] — This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
SecuronixCloseHistoricalXSOARIncidents [Securonix] — Close historical XSOAR incidents that are already closed on Securonix.
NOTE: This script will close all the XSOAR incidents which are created from Securonix integration and does not have incident type as "Securonix Incident" in the provided time frame.
SecuronixGetViolations [Securonix] — Gets a list of violations related to a specific threat from the context data and displays it in the layout.
SekoiaXDRAddComment [SekoiaXDR] — Script to add a comment to an alert in Sekoia, including the name of the person who made the comment.
SekoiaXDRChangeStatus [SekoiaXDR] — This script changes the status of the Sekoia alert.
SekoiaXDRPrintCase [SekoiaXDR] — Prints case details from the Sekoia alert.
SekoiaXDRPrintComments [SekoiaXDR] — Prints the comments fetched from the Sekoia alert in a table format.
SendAllPANWIoTAssetsToSIEM [PaloAltoNetworks_IoT3rdParty] — Retrieves all specified assets from the PANW IoT cloud and sends them to the SIEM server.
SendAllPANWIoTDevicesToCiscoISE [PaloAltoNetworks_IoT3rdParty] — Gets all available devices from the IoT cloud and updates or creates them on Cisco ISE using the custom attributes.
SendAllPANWIoTDevicesToServiceNow [PaloAltoNetworks_IoT3rdParty] — Gets all available devices from the IoT cloud and sends them to the ServiceNow. server
SendCPAction [CheckPointHEC] — Send quarantine or restore action and update action task id.
SendEmailOnSLABreach [CommonScripts] — Sends an email informing the user of an SLA breach. The email is sent to the user who is assigned to the incident. It includes the incident name, ID, name of the SLA field that was breached, duration of that SLA field, and the date and time when that SLA was started.
In order to run successfully, the script should be configured to trigger on SLA breach, through field edit mode.
SendEmailReply [EmailCommunication] — Send email reply
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SendEmailToManager [Active_Directory_Query] — Send an approval email to the manager of the employee with the given email allowing the manager to reply directly into the incident.
SendMessageToOnlineUsers [CommonScripts] — Send message to Demisto online users over Email, Slack, Mattermost or all.
SendNotificationAgentix [CommonScripts] — Sends a notification message to a user, group, or channel. Supports sending messages to Slack, Microsoft Teams, Mattermost or Zoom.
SendPANWIoTDevicesToCiscoISE [PaloAltoNetworks_IoT3rdParty] — This script takes (as a required argument) custom attributes from PANW IoT cloud
and creates or updates endpoints in ISE with the input custom attributes.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SentinelOneListAgents [SentinelOne] — This script is used to wrap the list-agents command in SentinelOne v2. Returns all agents that match the specified criteria.
ServerLogs [CommonScripts] — Uses the ssh integration to grab the host server logs. This script is supported only on Cortex XSOAR on-prem (version 6.X).
ServerLogs_docker [CommonScripts] — Uses the ssh integration to grab the host server logs. This script is supported only on Cortex XSOAR on-prem (version 6.X).
ServiceNowAddComment [ServiceNow] — Use this script to add a comment or work note to a ServiceNow ticket. To be run within the incident.
ServiceNowApiModule [ApiModules] — Common ServiceNow code that will be appended to each ServiceNow integration when it is deployed to automatically enable OAuth2 authentication.
ServiceNowCMDBEnrichAsset [ServiceNow] — This script resolves the owner and related configuration items of a network adapter by searching the ServiceNow CMDB network adapter table using a specified IP address.
ServiceNowCreateIncident [ServiceNow] — This script is used to wrap the generic create-record command in ServiceNow.
You can add fields that you want to create the record with as script arguments or in the
code and work with the records easily.
ServiceNowIncidentStatus [ServiceNow] — populates the value of the ServiceNow Ticket State field and display it in a layout widget.
ServiceNowQueryIncident [ServiceNow] — This script is used to wrap the generic query-table command in ServiceNow.
You can add fields that you want to use as inputs and outputs from the record as script arguments or in the
code and work with the records easily.
ServiceNowTroubleshoot [ServiceNow] — Troubleshot ServiceNow v2 integration by displaying health information of enabled instances and old and active incidents of disabled instances.
ServiceNowUpdateIncident [ServiceNow] — This script is used to wrap the generic update-record command in ServiceNow.
You can add fields that you want to update the record with as script arguments or in the
code and work with the records easily.
Set [CommonScripts] — Set a value in context under the key you entered.
SetAndHandleEmpty [CommonScripts] — Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SetByIncidentId [CommonScripts] — Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument.
Sets a value into the context with the given context key. Doesn't append by default.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SetDateField [CommonScripts] — Sets a custom incident field with current date.
SetGridField [CommonScripts] — Creates a Grid table from items or key-value pairs.
SetIRProceduresMarkdown [DemistoRESTAPI] — Creates markdown tables based on information from the GetTasksWithSection command.
SetIfEmpty [FiltersAndTransformers] — Checks an object for an empty value and returns a pre-set default value.
SetIndicatorAgentix [CommonScripts] — Updates the properties of an existing indicator and associates the indicator with related issues if they exist.
SetIndicatorGridField [CommonScripts] — This script updates an indicator's grid field in Cortex XSOAR with provided row data. You can input the rows directly or extract them from the context.
SetIndicatorTableData [DomainTools_Iris] — Sets Data for a Domain in the Indicator Table.
SetMultipleValues [CommonScripts] — Set multiple keys/values to the context.
SetPhishingCampaignDetails [Campaign] — Copying EmailCampaign context from current incident to other existing incident.
This script runs with elevated permissions.
Cortex XSOAR recommends using the built-in RBAC functionality to limit access to only those users requiring access to this script.
SetRDPOverallScore [RDPCacheHunting] — Sets the overall score for the strings similarity scoring for the text extracted from the RDP cache image.
SetRSANetWitnessAlertsMD [RSANetWitness_v11_1] — This automation takes several alert fields from the RSA NetWitness alerts context and displays them as markdown in the layout.
SetTagsBySearch [UpdateEntriesBySearch] — Search entries in the war room for the pattern text, and set tags to the entries found.
SetThreatVaultIncidentMarkdownRepresentation [PaloAltoNetworks_Threat_Vault] — This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.
SetTime [CommonScripts] — Fill the current time in a custom incident field.
SetWithTemplate [CommonScripts] — Set a value built by a template in context under the key you entered.
ShowCPEmailInfo [CheckPointHEC] — Get email info from Check Point Smart API.
ShowCPScanInfo [CheckPointHEC] — Get scan info from Check Point Smart API.
ShowCampaignHighestSeverity [Campaign] — Displays the highest severity among the incidents that make up the phishing campaign.
ShowCampaignIncidentsOwners [Campaign] — Displays all the campaign incident owners and their quantity.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ShowCampaignRecipients [Campaign] — Displays the phishing campaign recipients' email addresses and the number of incidents each email address appears in.
ShowCampaignSenders [Campaign] — Displays the phishing campaign senders' email addresses and the number of incidents each email address appears in.
ShowCampaignSimilarityRange [Campaign] — Displays the similarity range between the incidents that make up the phishing campaign.
ShowIncidentIndicators [CommonScripts] — This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL.
This script is a field-display script, so it needs to be configured as such, when editing the incident field that will be used to display the indicators.
ShowLocationOnMap [CommonScripts] — Show indicator geo location on map.
ShowNumberOfCampaignIncidents [Campaign] — Displays the number of phishing incidents that make up the phishing campaign.
ShowOnMap [CommonScripts] — Returns a map entry with a marker on the given coordinates (lat,lng), or address (requires a configured GoogleMaps instance).
ShowScheduledEntries [CommonScripts] — Show all scheduled entries for specific incident.
SiemApiModule [ApiModules] — Helpers and iteration logic using pydantic for Siem apps.
SigmaConverttoQuery [Sigma] — Allows converting a Sigma Rule indicator into a SIEM query.
SimpleDebugger [SimpleDebugger] — SimpleDebugger is a python class definition appended to CommonServerUserPython and dynamically included in every automation by the XSOAR automation execution environment. It is for debugging custom python automations in XSOAR. You can visually trace code execution, set breakpoints, step through the code, display local variables, and profile execution times of python functions.
SlackAsk [Slack] — Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.
SlackAskUser [DeprecatedContent] — Deprecated. Use the SlackAsk script instead.
SlackAskV2 [Slack] — Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook. Note: a message maximum length is 3000 characters enforced by Slack API.
SlackBlockBuilder [Slack] — SlackBlockBuilder will format a given Slack block into a format readable by the SlackV3 integration. The script will also send the block to the given destination. Make sure to mark **Trust any certificate** and fill the **XSOAR API Key integration** parameters if you want to get a response to the incident context.
SlackUtilsApiModule [ApiModules] — Slack-specific utilities for Cortex Assistant integration.
Handles Slack Block Kit formatting, message parsing, and UI element creation.
SnmpDetection [CortexAttackSurfaceManagement] — Deprecated. No available replacement.
SortBy [FiltersAndTransformers] — This transformer will sort an array of dictionary values by keys in ascending or descending order.
SplitCampaignContext [Campaign] — Splits incidents in the context data to below and above a similarity threshold.
If a low similarity incident was already added to the campaign,
then it will also be considered in the higher similarity incidents list.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SplunkAddComment [SplunkPy] — Use this script to add a comment with a tag (the "Comment tag to Splunk" defined in the instance configuration) as an entry in Cortex XSOAR, which will then be mirrored as a comment to a Splunk issue. This script should be run within an incident.
SplunkAddNote [SplunkPy] — Use this script to add a note with a tag (the "Note tag to Splunk" defined in the instance configuration) as an entry in Cortex XSOAR, which will then be mirrored as a note to a Splunk finding. This script should be run within an incident.
SplunkConvertConsolidatedFindingsToMD [SplunkPy] — Renders the Splunk Investigation `consolidated_findings` JSON payload as a Markdown summary (key/value table for scalar fields plus a transposed table for parallel array columns such as `search_name`, `_time`, `dest`, `risk_score`, `severity`, and `src`). Designed for use as a dynamic-section in the Splunk Investigation layout.
StringContains [DeveloperTools] — Deprecated. No available replacement. Checks whether substring is within string. Returns - yes - string contains substring. no - string does not contain substring. If stringSeperator is provided, the substring will be split using the separator, and each item will be checked. If one of the items will be found in the string, the srcipt will return yes. This script is deprecated. The StringContainsArray filter implements the exact functionality.
StringContainsArray [FiltersAndTransformers] — Checks whether a substring or an array of substrings is within a string array(each item will be checked). Supports single strings as well. For example, for substrings ['a','b','c'] in a string 'a' the script will return true.
StringLength [CommonScripts] — Returns the length of the string passed as argument
StringReplace [CommonScripts] — Replaces regex match/es in string.
Returns the string after replace was preformed.
StringSifter [StringSifter] — This script runs the StringSifter ML tool for malware analysis and ranking of words. You can enter an entryID or string_text as input.
StringSimilarity [CommonScripts] — This automation calculates the similarity ratio between every string in 2 different arrays and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common).
StringToArray [FiltersAndTransformers] — Converts string to array.
For example: `http://example.com/?score:1,4,time:55` will be transformed to `["http://example.com/?score:1,4,time:55"]`.
StringifyArray [FiltersAndTransformers] — Return the string encoded with JSON from the whole array
Strings [CommonScripts] — Extract strings from a file with optional filter - similar to binutils strings command.
StripAccentMarksFromString [CommunityCommonScripts] — Strip accent marks (diacritics) from a given string.
For example: "Niño שָׁלוֹם Montréal اَلسَّلَامُ عَلَيْكُمْ"
Will return: "Nino שלום Montreal السلام عليكم".
StripChars [FiltersAndTransformers] — Strip set of characters from prefix and/or suffix
e.g. StripChar value=~!!~www.mydomain.com~!~!~ chars=!~ will return www.mydomain.com
SuggestBranchName [ContentManagement] — The script gets the pack name as input and suggests an available branch name, for example:
pack name is "MyPack" the branch name will be "MyPack".
If a branch with the name "MyPack" exists, the script return "MyPack_1".
SumList [FiltersAndTransformers] — Sums a List
e.g. ["25", "10", "25"] => "60"
This is an example for number transformer.
SummarizeEmailThreads [EmailCommunication] — Dynamic-section script for 'Email Threads' layout.
This script searches for email threads stored in the Incident context and outputs a table summarizing them.
SumoLogicCloseLinkSignalIncidents [SumoLogic_Cloud_SIEM] — Close the linked signal incidents when the main Insight incident is closed.
SumoLogicLinkSignalIncidents [SumoLogic_Cloud_SIEM] — Command to link associated Signal Incidents to the Insight Incident.
TAXII2ApiModule [ApiModules] — Common TAXII 2 code that will be appended into each TAXII 2 integration when it's deployed.
TagIndicatorButton [PrismaCloudCompute] — This is a wrapper around the setIndicators script.
TextFromHTML [CommonScripts] — Extract regular text from the given HTML.
ThreatIntelManagementGetIncidentsPerFeed [ThreatIntelligenceManagement] — Total number of incidents per OOTB feed.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ThreatstreamBuildIocImportJson [Anomali_ThreatStream] — Builds A JSON array based on the values provided by the user for the 'threatstream-import-indicator-without-approval' command.
TimeComponents [FiltersAndTransformers] — Takes a date or time input and get time components in a specific time zone.
Returns a dictionary with the following components.
- year
- year_4_digit
- month
- month_3_letter
- month_full_name
- month_2_digit
- day
- day_2_digit
- day_of_week (Sun:0, Sat:6)
- day_of_week_3_letter
- day_of_week_full_name
- day_of_year
- day_of_year_3_digit
- hour
- hour_12_clock
- hour_2_digit_24_clock
- hour_2_digit_12_clock
- hour_of_day
- minute
- minute_2_digit
- minute_of_day
- second
- second_2_digit
- second_of_day
- millisecond
- period_12_clock
- time_zone_hhmm
- time_zone_offset
- time_zone_abbreviations
- unix_epoch_time
- iso_8601
- y-m-d
- yyyy-mm-dd
- h:m:s
- H:m:s
- hh:mm:ss
- HH:mm:ss.
TimeStampCompare [CommonScripts] — Compares a single timestamp to a list of timestamps.
TimeStampToDate [FiltersAndTransformers] — Converts UNIX Epoch time stamp to a simplified extended ISO format string. Use it to convert time stamp to Demisto date field
e.g. 1525006939 will return '2018-04-29T13:02:19.000Z'
TimeToNextShift [ShiftManagement] — Retrieves the time left until the next shift begins.
TimersOnOwnerChange [CaseManagement-Generic] — Stops the "Time To Assignment" timer once an owner is assigned to the Incident
Starts the "Remediation SLA' timer once an owner is assigned to the Incident.
ToTable [CommonScripts] — Convert an array to a nice table display. Usually, from the context.
TopMaliciousRatioIndicators [CommonScripts] — Find the top malicious ratio indicators.
Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.
TransformIndicatorToCSFalconIOC [CrowdStrikeFalcon] — Transform an indicator in Cortex into a CrowdStrike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CrowdStrike Falcon format. This JSON can be used as the input for the *cs-falcon-batch-upload-custom-ioc* command.
TransformIndicatorToMSDefenderIOC [MicrosoftDefenderAdvancedThreatProtection] — Transform a XSOAR indicator into a Microsoft Defender for Endpoint IOC. The output (at TransformIndicatorToMSDefenderIOC.JsonOutput) is a json representation of the indicators in MSDE format. This json can be the input for the *microsoft-atp-indicator-batch-update* command.
TroubleshootAggregateResults [Troubleshoot] — Collects all results from previous tasks. (Available from Cortex XSOAR 5.0.0.)
TroubleshootCloseAlertsByQuery [Troubleshoot] — Closes alerts by receiving a list of alert IDs and executing the closure process for each.
TroubleshootExecuteCommand [Troubleshoot] — Executes a command in Cortex XSOAR in debug mode and pulls logs from the command execution.
TroubleshootExecutePlaybookByAlertQuery [Troubleshoot] — Retrieves alerts based on a given query and filter arguments. It provides two operational modes:
1. Trigger Associated Playbooks: If no specific playbook is provided, the script automatically triggers the playbook that is individually associated with each alert found.
2. Override Playbook: If a specific playbook ID or name is provided, the script overrides the default playbooks of all matching alerts and uniformly applies the specified playbook to each one.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
TroubleshootGetCommandandArgs [Troubleshoot] — Gets a command with its arguments, validates the command and the arguments, and then parses it to use in the Cortex XSOAR context.
TroubleshootGetInstanceParameters [Troubleshoot] — Gets an instance's configuration parameters in order to troubleshoot the instance.
TroubleshootIsDockerImageExists [Troubleshoot] — Gets a Docker image and checks if it exists on the machine running Cortex XSOAR.
TroubleshootRestartFailedPlaybooks [Troubleshoot] — Scans all non-closed alerts for playbook tasks in Error state and restarts them from the specific failed task.
The script reopens each errored task and re-executes it, allowing the playbook to continue from where it stopped.
Includes throttling support via the group_size and sleep_time arguments: after every group_size task restarts the script pauses for sleep_time seconds to avoid overloading the engine queue when scanning many alerts.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
TroubleshootTestInstance [Troubleshoot] — Click the "Test" button and return if the test failed.
URLDecode [FiltersAndTransformers] — Converts
https:%2F%2Fexample.com
into
https://example.com
URLEncode [FiltersAndTransformers] — Encodes a URL string by replacing special characters in the string using the %xx escape. For example: https://example.com converts to https:%2F%2Fexample.com.
URLNumberOfAds [CommonScripts] — Fetches the numbers of ads in the given url.
URLReputation [CommonScripts] — A context script for URL entities.
UnEscapeIPs [CommonScripts] — Remove escaping chars from IP
127[.]0[.]0[.]1 -> 127.0.0.1
UnEscapeURLs [CommonScripts] — Extract URLs redirected by security tools like Proofpoint.
Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html
Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com.
UnPackFile [CommonScripts] — Deprecated. Use the UnzipFile script instead. UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context.
supported types are:
7z (.7z), ACE (.ace), ALZIP (.alz), AR (.a), ARC (.arc), ARJ (.arj), BZIP2 (.bz2), CAB (.cab), compress (.Z), CPIO (.cpio), DEB (.deb), DMS (.dms), GZIP (.gz), LRZIP (.lrz), LZH (.lha, .lzh), LZIP (.lz), LZMA (.lzma), LZOP (.lzo), RPM (.rpm), RAR (.rar), RZIP (.rz), TAR (.tar), XZ (.xz), ZIP (.zip, .jar) and ZOO (.zoo)
UnitTest [ContentTesting] — Provides for automated testing of automations, playbooks, and sub-playbooks.
UnitTestPlaybookAnalyzer [ContentTesting] — Profiles execution time of tasks in a playbook or sub-playbook (if specified). Provides minimum, maximum, and average task execution times in milliseconds as well as the state of each task: completed, error, notexecuted, started, and waiting.
UnzipFile [CommonScripts] — Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context.
UnzipGZFile [GZip] — Unzip a gz file and upload to war room
UpdateSecuronixIncidentStatus [Securonix] — Update the status of the Securonix incident using the configuration provided in integration configuration.
UpgradeCheck [ContentTesting] — Check content pack upgrade impacts and display changes. Packs argument is comma separated list of content pack names, or blank for all content packs to assess.
UploadFile [DemistoRESTAPI] — Copies a file from this incident to the specified incident. The file is recorded as an entry in the specified incident’s War Room.
UserEnrichAD [Active_Directory_Query] — Deprecated. Use ADGetUser instead.
UtilAnyResults [CommonScripts] — Utility script to use in playbooks - returns "yes" if the input is non-empty.
ValidateContent [Base] — Runs validation and linting using the Demisto SDK on content items, such as integrations, automations and content packs. This automation script is used as part of the content validation that runs as part of the contribution flow.
VectraDetectCloseDuplicateIncidents [Vectra_AI] — This script closes duplicate incidents in XSOAR while resolving the assignment for the corresponding Vectra entity.
VectraDetectDisplayDetections [Vectra_AI] — This script enables the display of detection details, available in the context, in the form of a markdown table.
VectraRUXGetIncidents [VectraRUX] — Get the incidents with the type Vectra RUX Events Detection.
VectraXDRDisplayEntityDetections [VectraXDR] — This script enables the display of detection details, available in the context, in the form of a markdown table.
VectraXDRGenerateMailBody [VectraXDR] — Generate an email body based on the detection assessment for MDR escalation process.
VerdictResult [CommonScripts] — This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field.
VerifyCIDR [CommonScripts] — Verify that the CIDRs are valid.
VerifyContext [DeveloperTools] — Deprecated. Use playbook filters instead. Verifies path in context - Verifies path existence - If matching object is an array - verify fields exists in each of the objects in the array - If matching object is not an array - verify fields exists in matching object - if 'expectedValue' is given - ensure that the given value is equal to the context path
VerifyContextFields [DeveloperTools] — Deprecated. Use playbook filters instead. Verify fields are in context.
VerifyEnoughIncidents [DeveloperTools] — Check whether a given query returns enough incidents.
VerifyEnoughIndicators [DeveloperTools] — Returns, whether there're, are enough indicators in the system.
VerifyIPv4Indicator [VerifyIPv4Indicator] — Verify that the address is a valid IPv4 address.
VerifyIPv6Indicator [CommonScripts] — Verify that the address is a valid IPv6 address.
VerifyIntegrationHealth [DeveloperTools] — Checks for existing errors in a given integration.
VerifyJSON [CommonScripts] — Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet.
VerifyObjectFieldsList [DeveloperTools] — Verifies that a given object includes all the given fields.
VerifyValidIP [CommonScripts] — Verifies if the given input contains valid IP addresses (IPv4 or IPv6).
VersionEqualTo [CommunityCommonScripts] — Tests whether left side version number is equal to right side version number.
Version numbers need to have at least a major and minor version component to be considered valid. E.g. 1.0
VersionGreaterThan [CommunityCommonScripts] — Tests whether left side version number is greater than right side version number.
Version numbers need to have at least a major and minor version component to be considered valid. E.g. 1.0
VersionLessThan [CommunityCommonScripts] — Tests whether left side version number is less than right side version number.
Version numbers need to have at least a major and minor version component to be considered valid. E.g. 1.0
VolApihooks [Volatility] — Volatility script for command apihooks
VolConnscan [Volatility] — Volatility script for command connscan
VolDlllist [Volatility] — Volatility script for command ldrmodules
VolGetProcWithMalNetConn [Volatility] — Volatility script for getting the list of processes that have connections to ip address with bad reputation.
VolImageinfo [Volatility] — Volatility script for command imageinfo
VolJson [Volatility] — Execute volatility with command and file as parameters and return output as json.
VolLDRModules [Volatility] — Volatility script for command ldrmodules
VolMalfind [Volatility] — Volatility script for command ldrmodules
VolNetworkConnections [Volatility] — Volatility script for finding all the network connections. This script runs through different commands based on the profile provided.
VolPSList [Volatility] — Volatility script for command pslist
VolRaw [Volatility] — Execute volatility with command and file as parameters and returns raw output from stdout.
VolRunCmds [Volatility] — Execute volatility with command and return tabular output. Incase where proper json output is not supported, scripts returns error. User should use raw command.
Volatility [Volatility] — Deprecated. No available replacement.
WaitAndCompleteTask [DeveloperTools] — Wait and complete tasks by given status. Used for test playbooks.
WaitForKey [XMatters] — A simple loop to inspect the context for a specific key. If the key is not found after "iterations" loops, the script exits with a message.
WebScraper [WebScraper] — An Automation Script to Web Scrap a URL or HTML Page.
WhereFieldEquals [FiltersAndTransformers] — Return all items from the list where their given 'field' attribute is equal to 'equalTo' argument
E.g. !WhereFieldEquals with the following arguments:
- value=[{ "name": "192.1,0.82", "type": "IP" }, { "name": "myFile.txt", "type": "File" }, { "name": "172.0.0.2", "type": "IP" }]
- field='type'
- equalTo='IP'
- getField='name'
Will return all items names where field 'type' equals 'IP' - ['192.1,0.82', '172.0.0.2'].
WhileLoop [DeveloperTools] — Deprecated. No available replacement. While loop is utility script, to do while loops on specific commands or scripts, it will allow you to loop over until some condition is fulfilled (${keyToWatch} == value). Please make sure timeout of the script also sufficient for the loop.
WidgetNoOp [CommonWidgets] — A no-op placeholder script used by visual-only widgets (e.g. Page Break, Text Widget) that require a script dataType but do not need to query any data source. Returns a mock result to prevent unnecessary database queries.
WordTokenizer [CommonScripts] — Deprecated. Use DBotPreProcessTextData instead.
WordTokenizerNLP [Base] — Deprecated. Use DBotPreProcessTextData instead.
XCloudIdentitiesWidget [CloudIncidentResponse] — This script retrieves the identity fields from the incident context.
XCloudProviderWidget [CloudIncidentResponse] — This script returns an HTML result of the cloud providers in the incident. The result will be displayed in the following font colors: AWS - red, GCP - green, Azure - blue.
XCloudRegionsPieWidget [CortexXDR] — XCLOUD dynamic section, showing the top ten regions types in a pie chart.
XCloudRelatedAlertsWidget [CloudIncidentResponse] — This script retrieves additional original alert information from the context.
XCloudResourcesPieWidget [CortexXDR] — XCLOUD dynamic section, showing the top ten resource types in a pie chart.
XDRConnectedEndpoints [CortexXDR] — The widget returns the number of the connected endpoints using xdr-get-endpoints command.
XDRDisconnectedEndpoints [CortexXDR] — The widget returns the number of the disconnected endpoints using xdr-get-endpoints command.
XDRSyncScript [CortexXDR] — Deprecated. No available replacement. Syncs a single incident between Demisto and XDR. This script always uses the xdr-get-incident-extra-data command and outputs to the context the entire incident JSON. When the incident is updated in XDR, the Demisto incident will be updated accordingly and the default playbook will rerun. When an incident is updated in Demisto, the script will execute the xdr-update-incident command and update the incident in XDR.
XMCyberDashboard [XMCyber] — Return the specific data for the XM Cyber Dashboard.
XSOARAllEDLCheckerAutomation [XSOAR_EDL_Checker] — Runs the xsoaredlchecker-get-edl command for all configured instances, and returns a consolidated output.
XSOARValueMetrics [CommunityCommonDashboards] — Collects metrics for a time window and the top 20 incident types in that period. Creates a small CSV with four tables 1) All Incidents 2) Closed Incidents 3) Open Duration 4) SLA timer durations. The time window is expected to be a complete month specified by the "firstday" and "lastday" arguments. If partial months are used, the open durations and SLA metrics is the average of the last set of incidents found, while incident counts are incremented.
The "slatimers" argument is a CSV list of custom SLA timer fields to include in the metrics.
Example: slatimers="customsla1,customsla2,customsla3"
The "filters" argument is a CSV list thats support the following field names to filter incidents on: status, notstatus, type, severity, owner:
"severity" values are: unknown, information, low, medium, high, critical
"status or notstatus" values are: pending, active, done, archive
"type" is the name of a single incident type
"owner" is the name of a single incident owner
Example: filters ="type=typea,status=done,severity=high"
If the "query" parameter is passed, the "filters" argument is ignored. The "query" parameter is a Lucene/Bleve search string in the incidents search box. The "query" string is used to select which incidents - do not specify any dates. These are controlled by the "firstday" and "lastday" parameters.
If the "windowstart" and "windowend" parameters are passed with the name of timer fields, the duration is calculated from windowend.endDate - windowstart.startDate for the "UserWindow" SLA metric.
The "mode" argument controls saving monthly statistics in this year's XSOAR list (a JSON object) as specified in the "thisyearlist" argument. The default mode is "increment" and expects the time windows for each query to be contiguous with no gaps or overlaps in the time window specified by the "firstday" and "lastday" arguments. If the time windows overlap, then incidents will be double counted. If there are gaps between time windows, then incidents may be missed. If the query needs to run and not update the saved statistics, use "mode=noupdate". In the event a month in the saved statistics becomes corrupted, this is corrected by using "mode=initialize" with the first day and the last day of the month to reset the values.
The "computeduration" argument allows the overall incident open duration to be computed from the created and closed dates versus using the openDuration field. Set to "yes" to use computed duration. This is helpful when incidents do not have valid data in the openDuration field.
YaraScan [Yara] — Performs a Yara scan on the specified files.
ZTAPBuildTimeline [ZeroTrustAnalyticsPlatform] — Deprecated. Comment ingestion simplified and audit log ingestion removed. No available replacement. Adds unmarked log/comment notes as evidence in the timeline.
ZTAPExtractFields [ZeroTrustAnalyticsPlatform] — Extracts ZTAP fields into a format parsable to grab as indicators
ZTAPParseFields [ZeroTrustAnalyticsPlatform] — Parses ZTAP event fields to display as key/value pairs in
a dynamic table.
ZTAPParseLinks [ZeroTrustAnalyticsPlatform] — Parses ZTAP external links to display in a dynamic table.
ZTAPViewTimeline [ZeroTrustAnalyticsPlatform] — View notes only relating to ZTAP.
ZipFile [CommonScripts] — Zip a file and upload to war room.
ZipStrings [CommonScripts] — Joins values from two lists by index according to a given format.
ZoomApiModule [ApiModules] — Common Zoom code that provides generic infrastructure, and will be appended to each Zoom integration when it is deployed.
ZoomAsk [Zoom] — Sends a message (question) to either user (in a direct message) or to a channel. The message includes predefined reply options. The response can also close a task (might be conditional) in a playbook.
block-domain [AggregatedScripts] — Blocks a list of domain FQDNs across the configured security products.
block-external-ip [AggregatedScripts] — The script blocks a list of IP addresses in supported integrations.
checkValue [CommonScripts] — Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly.
If an array is returned. the first value will be the decision making value.
clear-user-session [AggregatedScripts] — This script clears user sessions across multiple integrations for a list of usernames.
commentsToContext [CommonScripts] — Takes the comments of a given entry ID and stores them in the incident context, under a provided context key.
For accessing the last executed task's comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId input parameter.
cve-enrichment [AggregatedScripts] — Enriches CVE indicators with reputation data from multiple integrations and outputs a consolidated CVEEnrichment object. This script exclusively supports indicators of type CVE and will automatically create the indicator in TIM if it is not already exists.
cveLatest [CVESearch] — Deprecated. No available replacement. Displays the latest updated CVE entries.
cveReputation [CVESearch] — Deprecated. Use CveReputationV2 (in CommonScripts) instead.
cveReputationV2 [CommonScripts] — Provides the severity of the CVE based on the CVSS score where available.
cveSearch [CVESearch] — Deprecated. No available replacement. Search vulnerability information based on CVE ID.
cvss_color [CommonScripts] — This dynamic automation parses the CVSS score of a CVE and presents it in the layout in color according to its score.
device-security-alert-post-processing [PaloAltoNetworks_DeviceSecurity] — Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.
device-security-check-servicenow [PaloAltoNetworks_DeviceSecurity] — Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.
device-security-get-raci [PaloAltoNetworks_DeviceSecurity] — Calculates the responsible and informed parties for a Device Security incident by matching incident and device details against the Device Security configuration list.
device-security-vuln-post-processing [PaloAltoNetworks_DeviceSecurity] — Resolves the vulnerability incident in the Device Security portal via the API. Designed to run as a post-processing script.
disable-user [AggregatedScripts] — This script disables users for multiple services.
displayCloudIndicators [CloudIncidentResponse] — Display the Cloud indicators found in a dynamic-section
displayMappedFields [CommonScripts] — Display the mapped fields in a dynamic-section.
displaySiteCategory [SuspiciousDomainHunting] — This dynamic automation retrieves the category of a website and displays it in the layout.
displayUtilitiesResults [CommonScripts] — This script displays the execution results of the tab's buttons in an HTML table format.
domain-enrichment [AggregatedScripts] — Enriches Domain indicators with reputation data from multiple integrations and outputs a consolidated DomainEnrichment object. This script exclusively supports indicators of type Domain and will automatically create the indicator in TIM if it is not already exists.
emailFieldTriggered [CommonScripts] — Sends email to incident owner when selected field is triggered.
enrich_exclude_button [CommonScripts] — This script is only meant to be used to disable the Enrich Excluded button in an indicator. It should not be used otherwise.
expire-password [AggregatedScripts] — This script expires users password for multiple services.
file-enrichment [AggregatedScripts] — Enriches File indicators with reputation data from multiple integrations and outputs a consolidated FileEnrichment object. This script exclusively supports indicators of type File and will automatically create the indicator in TIM if it is not already exists. Note: The script runs core-get-hash-analytics-prevalence on SHA256 values only.
findIncidentsWithIndicator [CommonScripts] — Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
- For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
- For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
- For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
get-endpoint-data [AggregatedScripts] — This script gathers endpoint data from multiple integrations and returns an endpoint entity with consolidated information to the context.
get-user-data [AggregatedScripts] — This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context.
getAutomationsCount [HealthCheck] — Get the count of OOTB, custom and deprecated automations.
getContentPackStatus [HealthCheck] — Get the count of Marketplace content packs update status.
getCustomAutomations [HealthCheck] — Get the list of custom automations modified in last 30 days.
getCustomPlaybooks [HealthCheck] — Get the list of custom playbooks created in last 30 days.
getInvHealthStatus [HealthCheck] — Get the count of big incidents, incidents with big context and big indicators.
getPlaybooksCount [HealthCheck] — Get the count of custom, OOTB and deprecated playbooks.
getPlaybooksHealthStatus [HealthCheck] — Get the count of big workplan, big tasks playbooks and the playbooks which automatically turned in to quiet mode.
getSystemHealthStatus [HealthCheck] — Get the count of slow searches, web socket disconnects(in last 12hrs).
getWorkersCount [HealthCheck] — Get the count of Available, Busy and Total workers.
hideFieldsOnNewIncident [CommonScripts] — When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode.
http [CommonScripts] — Sends http request. Returns the response as json.
imagecompare [SuspiciousDomainHunting] — Compares two images and returns a similarity score.
indicator-enrichment [AggregatedScripts] — Enriches indicators from a provided list or a block of free text. This script detects the indicator type and runs the correct underlying enrichment script. Currently supports: IP, URL, Domain, CVE, and File.
iot-security-alert-post-processing [PaloAltoNetworks_IoT] — IoT alert post processing script to resolve the alert in IoT security portal using API
iot-security-check-servicenow [PaloAltoNetworks_IoT] — Close the XSOAR incident if the IoT ServiceNow ticket was closed. This command should be run in a Job.
iot-security-vuln-post-processing [PaloAltoNetworks_IoT] — IoT vulnerability post processing script to resolve the vulnerability incident in IoT security portal using API
ip-enrichment [AggregatedScripts] — Enriches IP indicators with reputation data from multiple integrations and outputs a consolidated IPEnrichment object. This script exclusively supports indicators of type IPv4 (IPv6 is not supported) and will automatically create the indicator in TIM if it is not already exists. Note: If enabled, get-endpoint-data is executed only for internal IP addresses.
isArrayItemInList [CommunityCommonScripts] — This automation is for comparing array(list) data of context to existing lists on XSOAR server. You can avoid using loop of sub-playbook.
inputArray: the context array/list data
listName: the XSOAR system list.
isError [CommonScripts] — Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error.
isolate-endpoint [AggregatedScripts] — This script isolates endpoints using multiple integrations and returns a success or failure message.
jmespath [FiltersAndTransformers] — Performs a JMESPath search on an input JSON format, when using a transformer.
jq [CommunityCommonScripts] — Deprecated. Use JMESPath transformer from the Filters and Transformers content pack instead.
qrcodereader [QRCodeReader] — Decodes an QR Code offline using opencv, returns the value to Context or False.
quarantine-file [AggregatedScripts] — This script executes the 'quarantine-file' command on a specified file via the appropriate agent. This script is used to isolate files identified as suspicious. Currently supported brands are "Cortex XDR - IR", "Cortex Core - IR", and "Microsoft Defender Advanced Threat Protection".
redactindicator [CommunityCommonScripts] — Redactindicator can help you to defang/redact any kind of indicator (IPv4, url, domain and email), IP addresses will be in the dotted representation like 8.8.8[.].8, all domains will be example[.]com. Optional you can define a "searchkey" which does not to be case sensitive, which will be replaced as <REDACTED>.
script-JiraChangeTransition [Jira] — This script applies the transition supplied by the user from the Jira Transitions incident field. It gets the new Jira status after applying the transition and updates the Cortex XSOAR incident status.
script-JiraListTransition [Jira] — This script lists all possible transitions for a given Jira issue.
ticksToTime [CommonScripts] — Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft.
url-enrichment [AggregatedScripts] — Enriches URL indicators with reputation data from multiple integrations and outputs a consolidated URLEnrichment object. This script exclusively supports indicators of type URL and will automatically create the indicator in TIM if it is not already exists.
varonis-alert-post-processing [VaronisSaaS] — Varonis alert post processing script to set the alert status to closed when an incident is closed.
xsoar-ws-parse-context [XsoarWebserver] — To parse the context data after running xsoar-ws-get-action-status and resend emails to recipients who have not responded
xsoar-ws-poll-status [XsoarWebserver] — Companion automation to XSOAR-Web-Server that polls a certain UUID for user response.
The automation returns a scheduledcommand if the user has not responded to the action url.