SplunkAddNote

Use this script to add a note with a tag (the "Note tag to Splunk" defined in the instance configuration) as an entry in Cortex XSOAR, which will then be mirrored as a note to a Splunk finding. This script should be run within an incident.

Type: python
Pack: SplunkPy

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def add_note(args: Dict[str, Any]) -> CommandResults:
    demisto.debug("adding note")
    tags = argToList(args.get("tags", ["FROM XSOAR"]))
    note_body = args.get("note", "")

    return CommandResults(readable_output=note_body, mark_as_note=True, tags=tags)


def main():  # pragma: no cover
    try:
        demisto.debug("SplunkAddNote is being called")
        res = add_note(demisto.args())
        return_results(res)

    except Exception as ex:
        return_error(f"Failed to execute SplunkAddNote. Error: {ex!s}")


if __name__ in ["__builtin__", "builtins", "__main__"]:
    main()

README

Use this script to add a note with a tag (the “Note tag to Splunk” defined in the instance configuration) as an entry in Cortex XSOAR, which will then be mirrored as a note to a Splunk finding. This script should be run within an incident.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.0.0

Inputs

Argument Name	Description
note	Note to be added to the Splunk finding.
tag	The note tag. Use the note entry tag (defined in your instance configuration) to mirror the note to splunk.

Outputs

There are no outputs for this script.