findIncidentsWithIndicator

Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

javascript · Common Scripts

Details

ID	`findIncidentsWithIndicator`
Language	javascript
From Version	5.0.0
Tags	Utility

README

Looks up incidents with a specified indicator. Uses currentIncidentId to omit the existing incident from output.

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	javascript
Tags	Utility

Inputs

Argument Name	Description
indicator	The indicator to search for.

Outputs

Path	Description	Type
IncidentsWithIndicator.Indicator	The indicator that was found in other incidents.	Unknown
IncidentsWithIndicator.incidentIDs	The incident IDs that the indicator was found in.	Unknown

Source

FindIncidentsWithIndicator.js FindIncidentsWithIndicator.yml

Download History Raw

commonfields:
  id: findIncidentsWithIndicator
  version: -1
name: findIncidentsWithIndicator
script: ''
type: javascript
tags:
- Utility
comment: |-
  Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output.

  This automation runs using the default Limited User role, unless you explicitly change the permissions.
  For more information, see the section about permissions here:
  - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
  - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
  - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
enabled: true
args:
- name: indicator
  required: true
  default: true
  description: Indicator to search for.
outputs:
- contextPath: IncidentsWithIndicator.Indicator
  description: Indicator that was found in other incidents.
- contextPath: IncidentsWithIndicator.incidentIDs
  description: Incident IDs that the indicator was found in.
scripttarget: 0
tests:
- No test
fromversion: 5.0.0