> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/script-commands.md).
# Script Commands
* [getScripts](#getscripts)
* [getScriptCode](#getscriptcode)
* [getScriptMetadata](#getscriptmetadata)
* [getScriptExecutionResults](#getscriptexecutionresults)
* [getScriptExecutionResultFiles](#getscriptexecutionresultfiles)
* [getScriptExecutionStatus](#getscriptexecutionstatus)
* [runScriptExecuteCommands](#runscriptexecutecommands)
* [runScriptFileExists](#runscriptfileexists)
* [runScriptDeleteFile](#runscriptdeletefile)
* [runScriptKillProcess](#runscriptkillprocess)
* [runSnippetCodeScript](#runsnippetcodescript)
* [scriptRun](#scriptrun)
#### getScripts
***
Gets a list of scripts available in the scripts library. If no arguments are provided, all available scripts are returned.
Arguments
| Argument Name | Description | Required |
| -------------------- | ----------------------------------------------------------------------------------------- | -------- |
| script\_names | A comma-separated list of the script names. | Optional |
| script\_descriptions | A comma-separated list of the script descriptions. | Optional |
| created\_by | A comma-separated list of the users who created the script. | Optional |
| limit | The maximum number of scripts returned to the War Room. Default is 50. | Optional |
| offset | Offset in the data set. Default is 0. | Optional |
| windows\_supported | Choose to run the script on a Windows operating system. Possible values are: true, false. | Optional |
| linux\_supported | Choose to run the script on a Linux operating system. Possible values are: true, false. | Optional |
| macos\_supported | Choose to run the script on a Mac operating system. Possible values are: true, false. | Optional |
| is\_high\_risk | Choose if the script has a high-risk outcome. Possible values are: true, false. | Optional |
Outputs
**Core.Scripts.name** *string*
Name of the script.
**Core.Scripts.description** *string*
Description of the script.
**Core.Scripts.script\_uid** *string*
Globally unique identifier of the script, used to identify the script when executing.
**Core.Scripts.modification\_date** *number*
Timestamp (epoch ms) of when the script was last modified.
**Core.Scripts.created\_by** *string*
Name of the user who created the script.
**Core.Scripts.windows\_supported** *boolean*
Whether the script can run on a Windows operating system.
**Core.Scripts.linux\_supported** *boolean*
Whether the script can run on a Linux operating system.
**Core.Scripts.macos\_supported** *boolean*
Whether the script can run on a Mac operating system.
**Core.Scripts.is\_high\_risk** *boolean*
Whether the script has a high-risk outcome.
#### getScriptCode
***
Gets the code of a specific script in the script library.
Arguments
| Argument Name | Description | Required |
| ------------- | -------------------------------------------------------------------- | -------- |
| script\_uid | Unique identifier of the script, returned by the getScripts command. | Required |
Outputs
**Core.ScriptCode.code** *string*
The code of a specific script in the script library.
**Core.ScriptCode.script\_uid** *string*
Unique identifier of the script.
#### getScriptMetadata
***
Gets the full definition of a specific script in the scripts library.
Arguments
| Argument Name | Description | Required |
| ------------- | -------------------------------------------------------------------- | -------- |
| script\_uid | Unique identifier of the script, returned by the getScripts command. | Required |
Outputs
**Core.ScriptMetadata.created\_by** *string*
Name of the user who created the script.
**Core.ScriptMetadata.description** *string*
Script description.
**Core.ScriptMetadata.entry\_point** *string*
Name of the entry point selected for the script. An empty string indicates the script defined as just run.
**Core.ScriptMetadata.is\_high\_risk** *boolean*
Whether the script has a high-risk outcome.
**Core.ScriptMetadata.linux\_supported** *boolean*
Whether the script can run on a Linux operating system.
**Core.ScriptMetadata.macos\_supported** *boolean*
Whether the script can run on a Mac operating system.
**Core.ScriptMetadata.modification\_date** *number*
Timestamp (epoch ms) of when the script was last modified.
**Core.ScriptMetadata.name** *string*
Script name.
**Core.ScriptMetadata.script\_id** *number*
Numeric script ID.
**Core.ScriptMetadata.script\_input** *unknown*
Name and type for the specified entry point.
**Core.ScriptMetadata.script\_output\_dictionary\_definitions.friendly\_name** *string*
User-friendly name for the output field.
**Core.ScriptMetadata.script\_output\_dictionary\_definitions.name** *string*
Programmatic name of the output field.
**Core.ScriptMetadata.script\_output\_dictionary\_definitions.type** *string*
Data type of the output field.
**Core.ScriptMetadata.script\_output\_type** *string*
Type of the output.
**Core.ScriptMetadata.script\_uid** *string*
Globally unique identifier of the script.
**Core.ScriptMetadata.windows\_supported** *boolean*
Whether the script can run on a Windows operating system.
#### getScriptExecutionResults
***
Retrieves the results of a script execution action.
Arguments
| Argument Name | Description | Required |
| ------------- | ----------------------------------------------------------------------------------------------------- | -------- |
| action\_ids | A comma-separated list of the action IDs returned from the runScript / runSnippetCodeScript commands. | Required |
Outputs
**Core.ScriptResult.action\_id** *number*
Action identifier of the script execution.
**Core.ScriptResult.endpoint\_id** *string*
Endpoint identifier.
**Core.ScriptResult.endpoint\_name** *string*
Endpoint hostname.
**Core.ScriptResult.endpoint\_ip\_address** *unknown*
Endpoint IP address(es).
**Core.ScriptResult.endpoint\_status** *string*
Endpoint connectivity status.
**Core.ScriptResult.domain** *string*
Endpoint domain.
**Core.ScriptResult.execution\_status** *string*
Per-endpoint script execution status.
**Core.ScriptResult.return\_value** *unknown*
Script return value.
**Core.ScriptResult.standard\_output** *string*
Script standard output.
**Core.ScriptResult.retrieved\_files** *number*
Number of files retrieved from the endpoint.
**Core.ScriptResult.failed\_files** *number*
Number of files that failed to be retrieved.
**Core.ScriptResult.retention\_date** *unknown*
Result retention date.
**Core.ScriptResult.command** *string*
Dynamic command name.
**Core.ScriptResult.command\_output** *unknown*
Dynamic command output.
#### getScriptExecutionResultFiles
***
Retrieves the files retrieved from a specific endpoint after running a script. Returns a single zip file entry; no context output.
Arguments
| Argument Name | Description | Required |
| ------------- | ---------------------------------------------------------------------------------- | -------- |
| action\_id | The action ID retrieved from the runScript command. | Required |
| endpoint\_id | The endpoint ID. To retrieve a list of endpoint IDs, run the getEndpoints command. | Required |
**Outputs**
There are no outputs for this command.
#### getScriptExecutionStatus
***
Retrieves the status of a script execution action.
Arguments
| Argument Name | Description | Required |
| ------------- | ----------------------------------------------------------------------------------------------------- | -------- |
| action\_ids | A comma-separated list of the action IDs returned from the runScript / runSnippetCodeScript commands. | Required |
Outputs
**Core.ScriptStatus.action\_id** *number*
Numeric action ID echoed from the request.
**Core.ScriptStatus.endpoints\_canceled** *number*
Number of endpoints with canceled script executions.
**Core.ScriptStatus.endpoints\_expired** *number*
Number of endpoints with expired script executions.
**Core.ScriptStatus.endpoints\_failed** *number*
Number of endpoints with failed script executions.
**Core.ScriptStatus.endpoints\_in\_progress** *number*
Number of endpoints with in-progress script executions.
**Core.ScriptStatus.endpoints\_pending** *number*
Number of endpoints with pending script executions.
**Core.ScriptStatus.endpoints\_pending\_abort** *number*
Number of endpoints whose script executions are pending abort.
**Core.ScriptStatus.endpoints\_succeeded** *number*
Number of endpoints with succeeded script executions.
**Core.ScriptStatus.endpoints\_timeout** *number*
Number of endpoints with timed-out script executions.
**Core.ScriptStatus.general\_status** *string*
Overall status of the action across all endpoints.
#### runScriptExecuteCommands
***
Executes shell commands (bash/native or PowerShell) on selected endpoints. Use command\_type=powershell for Windows PowerShell commands. Results are returned in the Standard Output field.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------- | -------- |
| endpoint\_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. | Optional |
| commands | A comma-separated list of shell commands to execute. | Optional |
| is\_raw\_command | Whether to pass the command as-is without splitting by commas. Possible values are: true, false. | Optional |
| command\_type | The type of shell command. Possible values are: powershell, native. | Optional |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| case\_id | Links the response action to the case that triggered it. | Optional |
| interval\_in\_seconds | Interval in seconds between each poll. | Optional |
| timeout\_in\_seconds | Polling timeout in seconds. | Optional |
Outputs
**Core.ScriptRun.action\_id** *number*
The action ID of the script execution.
**Core.ScriptRun.endpoints\_count** *number*
Number of endpoints the script was sent to.
#### runScriptFileExists
***
Checks whether one or more files exist on selected endpoints. Results are returned in the Command Output field (true if exists, false if not found).
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------- | -------- |
| endpoint\_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. | Optional |
| file\_path | A comma-separated list of file paths to check. | Optional |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| case\_id | Links the response action to the case that triggered it. | Optional |
| interval\_in\_seconds | Interval in seconds between each poll. | Optional |
| timeout\_in\_seconds | Polling timeout in seconds. | Optional |
Outputs
**Core.ScriptRun.action\_id** *number*
The action ID of the script execution.
**Core.ScriptRun.endpoints\_count** *number*
Number of endpoints the script was sent to.
#### runScriptDeleteFile
***
Deletes one or more files by path on selected endpoints. Results are returned in the Command Output field (true if deleted, false if not found).
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------- | -------- |
| endpoint\_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. | Optional |
| file\_path | A comma-separated list of file paths to delete. | Optional |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| case\_id | Links the response action to the case that triggered it. | Optional |
| interval\_in\_seconds | Interval in seconds between each poll. | Optional |
| timeout\_in\_seconds | Polling timeout in seconds. | Optional |
Outputs
**Core.ScriptRun.action\_id** *number*
The action ID of the script execution.
**Core.ScriptRun.endpoints\_count** *number*
Number of endpoints the script was sent to.
#### runScriptKillProcess
***
Kills one or more running processes by name on selected endpoints. Results are returned in the Standard Output field (e.g., 'Processes with name X found: 1 killed: 1').
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------- | -------- |
| endpoint\_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. | Optional |
| process\_name | A comma-separated list of process names to kill. | Optional |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| case\_id | Links the response action to the case that triggered it. | Optional |
| interval\_in\_seconds | Interval in seconds between each poll. | Optional |
| timeout\_in\_seconds | Polling timeout in seconds. | Optional |
Outputs
**Core.ScriptRun.action\_id** *number*
The action ID of the script execution.
**Core.ScriptRun.endpoints\_count** *number*
Number of endpoints the script was sent to.
#### runSnippetCodeScript
***
Executes arbitrary Python code on selected endpoints. Use this for quick ad-hoc Python execution without needing a pre-built script. Results are returned in the Command Output field.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------- | -------- |
| endpoint\_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. | Optional |
| snippet\_code | A snippet of Python script code to execute on the target endpoints. | Optional |
| case\_id | Links the response action to the case that triggered it. | Optional |
| interval\_in\_seconds | Interval in seconds between each poll. | Optional |
| timeout\_in\_seconds | Polling timeout in seconds. | Optional |
Outputs
**Core.ScriptRun.action\_id** *number*
The action ID of the script execution.
**Core.ScriptRun.endpoints\_count** *number*
Number of endpoints the script was sent to.
#### scriptRun
***
Runs any script from the XDR script library by UID with custom parameters. Use getScripts to find available scripts and their UIDs. Results vary by script and are returned in Standard Output or Command Output.
Arguments
| Argument Name | Description | Required |
| ------------------------------ | --------------------------------------------------------------------------------------------------- | -------- |
| endpoint\_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command. | Required |
| script\_uid | Unique identifier of the script. Can be retrieved by running the core-get-scripts command. | Required |
| parameters | Dictionary containing the parameter name as key and its value for this execution. | Optional |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| case\_id | Links the response action to the case that triggered it. | Optional |
| polling\_interval\_in\_seconds | Interval in seconds between each poll. Default is 10. | Optional |
| polling\_timeout\_in\_seconds | Polling timeout in seconds. Default is 600. | Optional |
Outputs
**Core.ScriptResult.action\_id** *number*
Action identifier of the script execution.
**Core.ScriptResult.endpoint\_id** *string*
Endpoint identifier.
**Core.ScriptResult.endpoint\_name** *string*
Endpoint hostname.
**Core.ScriptResult.endpoint\_ip\_address** *unknown*
Endpoint IP address(es).
**Core.ScriptResult.endpoint\_status** *string*
Endpoint connectivity status.
**Core.ScriptResult.domain** *string*
Endpoint domain.
**Core.ScriptResult.execution\_status** *string*
Per-endpoint script execution status.
**Core.ScriptResult.return\_value** *unknown*
Script return value.
**Core.ScriptResult.standard\_output** *string*
Script standard output.
**Core.ScriptResult.retrieved\_files** *number*
Number of files retrieved from the endpoint.
**Core.ScriptResult.failed\_files** *number*
Number of files that failed to be retrieved.
**Core.ScriptResult.retention\_date** *unknown*
Result retention date.
**Core.ScriptResult.command** *string*
Dynamic command name.
**Core.ScriptResult.command\_output** *unknown*
Dynamic command output.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/script-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.