commonfields:
  id: findIncidentsWithIndicator
  version: -1
name: findIncidentsWithIndicator
script: ''
type: javascript
tags:
- Utility
comment: |-
  Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output.

  This automation runs using the default Limited User role, unless you explicitly change the permissions.
  For more information, see the section about permissions here:
  - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
  - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
  - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
enabled: true
args:
- name: indicator
  required: true
  default: true
  description: Indicator to search for.
outputs:
- contextPath: IncidentsWithIndicator.Indicator
  description: Indicator that was found in other incidents.
- contextPath: IncidentsWithIndicator.incidentIDs
  description: Incident IDs that the indicator was found in.
scripttarget: 0
tests:
- No test
fromversion: 5.0.0