Create a Script

Create automation scripts in Cortex AgentiX to run custom security workflows.

Custom scripts automate repetitive tasks and streamline security operations.

1. Navigate to Investigation & Response → Automation → Scripts and click New Script.
2. Add an identifying name for the script.
3. Click Save.
4. In the Agentic Assistant pane, start a conversation with the Automation Engineer agent to create the script, or manually create the script code and define the script settings.

   For more information, see Accelerate script development using the Automation Engineer agent. For script settings, see Create a Script.
5. Save the script version.
6. (Recommended) Click Test to validate your script.

   1. In the Arguments section, provide values for any inputs your prompt requires. These inputs are used to simulate how the script will behave in a live playbook, or how the script registered as an Action and assigned to an Agent will run as part of an executed plan.

      You can add input values manually.
   2. Click Run.

      The tests are executed in a Playground environment. Review the output generated by the AI to validate the script's behavior and ensure it produces the expected results. The output is typically a text summary or another structured format that you have defined.

      If there is an error, you can copy the error message from the test result into the Agentic Assistant prompt and ask the Automation Engineer agent to correct the error.

      In each run result, you can take the following actions:

      Action	Description
      Mark as note	Marks the entry as a note, which can help you understand why certain action was taken and assist future decisions. When marked as a note, it is highlighted, so you can easily find it in the War Room or the Issue Overview tab.
      View artifact in new tab	Opens a new tab for the artifact.
      Download artifact	Downloads the run details to a text file, including the AI task name,, the script name, user name and password, and the result.
      Add tags	Add any relevant tags to use that help you find relevant information.

7. (Optional) Click and select Register new Action to register the script as an Action. For more information, see Manage actions.

• You can enable/disable a script in the Settings without having to duplicate the script.
• You can view recently modified or deleted scripts by clicking the version history for all scripts .

Basic script settings

Important

Role-Based access: Your ability to configure or test scripts that use stored credentials depends on your role's Credentials permission. If set to None, you cannot reference pre-saved secrets during configuration or testing.

Parameter	Description
Name	An identifying name for the script.
Language type	Select the script language. Python scripts support the Automation Engineer agent in Agentic Assistant.
Description	A meaningful description of the script.
Tags	Predefined script identifiers. For example, if a script is intended for phishing, tagging it with the phishing tag helps organize, classify, and manage the script among other scripts. Organizations can also implement policies or restrictions based on tags associated with scripts. For example, they may restrict certain users from accessing or executing a script tagged for phishing..
Enabled	Makes the script available for playbook tasks, indicator types, or CLI execution.

Arguments and outputs

Create, edit, or delete arguments as needed.

Parameter	Description
Argument	An identifying name.
Mandatory	Makes the argument required.
Sensitive	Hides the argument from being displayed in the UI and in logs. Authentication (Type 9) Arguments: For scripts that use credential-type arguments, users with the Credentials permission set to None will see the message Credentials are locked by admin and will be unable to select pre-saved secrets from the UI dropdown.
Description	A meaningful description.
Default	The default value.
Is array	Specifies an array.
List options	A comma-separated list of values.

Create, edit, or delete outputs as needed. Define outputs as strings, numbers, dates, or Booleans. See Context and Outputs.

Parameter	Description
Context Path	A dot-notation Context path, such as ThreatStream.Analysis.ReportID.
Description	A short description of the context path.
Type	The value type, such as string, number, or date.

Permissions and advanced settings

Parameter	Description
Password Protect	Requires a password when running the script from the CLI.
Timeout (seconds)	Time before the script times out. The default is 180 seconds.
Docker image name	The Docker image for Python scripts. The default is demisto/python3. Cortex AgentiX supports Python 2.7 and Python 3.0 or later.
Run on a separate container	Runs the script in a separate container.

Dependencies and code

Set required commands in these settings or in the script YAML file.

Modify parameters, logic, or integrations to adapt existing scripts. Script Helper lists available commands and scripts.