SearchIndicatorInEvents
Searches for a specific indicator in the tenant's event and log data, and extracts the logs the indicator appears in.
python · Core
Details
| ID | SearchIndicatorInEvents |
|---|---|
| Language | python |
| From Version | 6.1.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Tags | Utilities |
README
Searches for a specific indicator in the tenant’s event and log data, and extracts the logs the indicator appears in.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | Utilities |
| Cortex XSOAR Version | 6.1.0 |
Inputs
| Argument Name | Description |
|---|---|
| indicator | The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs. |
| time_frame | The search timeframe in days (e.g., “7 days” means searching the past 7 days of data). |
| data_set | The dataset for the search. By default, this is “xdr_data”. |
| query_name | The name to use for the query results. Find the query results under this name in the War Room context. |
| interval_in_seconds | The interval in seconds for checking query completion. |
| timeout_in_seconds | The maximum time to wait for the query to finish (in seconds). The command fails if the query takes longer. |
Outputs
| Path | Description | Type |
|---|---|---|
| PaloAltoNetworksXQL | A list of event records (constructed as dictionaries) where the specified indicator was found. | List |
commonfields: id: SearchIndicatorInEvents version: -1 name: SearchIndicatorInEvents script: '' type: python tags: - Utilities comment: Searches for a specific indicator in the tenant's event and log data, and extracts the logs the indicator appears in. enabled: true args: - name: indicator required: true description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs. - name: time_frame required: true defaultValue: 7 days description: The search timeframe in days (e.g., "7 days" means searching the past 7 days of data). - name: data_set defaultValue: xdr_data description: The dataset for the search. By default, this is "xdr_data". - name: query_name required: true description: The name to use for the query results. Find the query results under this name in the War Room context. - name: query_id hidden: true description: The internal ID for the query. It cannot be set manually. - name: interval_in_seconds defaultValue: '30' description: The interval in seconds for checking query completion. - name: timeout_in_seconds defaultValue: '600' description: The maximum time to wait for the query to finish (in seconds). The command fails if the query takes longer. outputs: - contextPath: PaloAltoNetworksXQL description: A list of event records (constructed as dictionaries) where the specified indicator was found. type: List scripttarget: 0 subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 6.1.0 tests: - No tests (auto formatted) polling: true marketplaces: - marketplacev2 - platform