Script Commands

• getScripts
• getScriptCode
• getScriptMetadata
• getScriptExecutionResults
• getScriptExecutionResultFiles
• getScriptExecutionStatus
• runScriptExecuteCommands
• runScriptFileExists
• runScriptDeleteFile
• runScriptKillProcess
• runSnippetCodeScript
• scriptRun

getScripts

---

Gets a list of scripts available in the scripts library. If no arguments are provided, all available scripts are returned.

Arguments

Argument Name	Description	Required
script_names	A comma-separated list of the script names.	Optional
script_descriptions	A comma-separated list of the script descriptions.	Optional
created_by	A comma-separated list of the users who created the script.	Optional
limit	The maximum number of scripts returned to the War Room. Default is 50.	Optional
offset	Offset in the data set. Default is 0.	Optional
windows_supported	Choose to run the script on a Windows operating system. Possible values are: true, false.	Optional
linux_supported	Choose to run the script on a Linux operating system. Possible values are: true, false.	Optional
macos_supported	Choose to run the script on a Mac operating system. Possible values are: true, false.	Optional
is_high_risk	Choose if the script has a high-risk outcome. Possible values are: true, false.	Optional

Outputs

Core.Scripts.name string

Name of the script.

Core.Scripts.description string

Description of the script.

Core.Scripts.script_uid string

Globally unique identifier of the script, used to identify the script when executing.

Core.Scripts.modification_date number

Timestamp (epoch ms) of when the script was last modified.

Core.Scripts.created_by string

Name of the user who created the script.

Core.Scripts.windows_supported boolean

Whether the script can run on a Windows operating system.

Core.Scripts.linux_supported boolean

Whether the script can run on a Linux operating system.

Core.Scripts.macos_supported boolean

Whether the script can run on a Mac operating system.

Core.Scripts.is_high_risk boolean

Whether the script has a high-risk outcome.

getScriptCode

---

Gets the code of a specific script in the script library.

Arguments

Argument Name	Description	Required
script_uid	Unique identifier of the script, returned by the getScripts command.	Required

Outputs

Core.ScriptCode.code string

The code of a specific script in the script library.

Core.ScriptCode.script_uid string

Unique identifier of the script.

getScriptMetadata

---

Gets the full definition of a specific script in the scripts library.

Arguments

Argument Name	Description	Required
script_uid	Unique identifier of the script, returned by the getScripts command.	Required

Outputs

Core.ScriptMetadata.created_by string

Name of the user who created the script.

Core.ScriptMetadata.description string

Script description.

Core.ScriptMetadata.entry_point string

Name of the entry point selected for the script. An empty string indicates the script defined as just run.

Core.ScriptMetadata.is_high_risk boolean

Whether the script has a high-risk outcome.

Core.ScriptMetadata.linux_supported boolean

Whether the script can run on a Linux operating system.

Core.ScriptMetadata.macos_supported boolean

Whether the script can run on a Mac operating system.

Core.ScriptMetadata.modification_date number

Timestamp (epoch ms) of when the script was last modified.

Core.ScriptMetadata.name string

Script name.

Core.ScriptMetadata.script_id number

Numeric script ID.

Core.ScriptMetadata.script_input unknown

Name and type for the specified entry point.

Core.ScriptMetadata.script_output_dictionary_definitions.friendly_name string

User-friendly name for the output field.

Core.ScriptMetadata.script_output_dictionary_definitions.name string

Programmatic name of the output field.

Core.ScriptMetadata.script_output_dictionary_definitions.type string

Data type of the output field.

Core.ScriptMetadata.script_output_type string

Type of the output.

Core.ScriptMetadata.script_uid string

Globally unique identifier of the script.

Core.ScriptMetadata.windows_supported boolean

Whether the script can run on a Windows operating system.

getScriptExecutionResults

---

Retrieves the results of a script execution action.

Arguments

Argument Name	Description	Required
action_ids	A comma-separated list of the action IDs returned from the runScript / runSnippetCodeScript commands.	Required

Outputs

Core.ScriptResult.action_id number

Action identifier of the script execution.

Core.ScriptResult.endpoint_id string

Endpoint identifier.

Core.ScriptResult.endpoint_name string

Endpoint hostname.

Core.ScriptResult.endpoint_ip_address unknown

Endpoint IP address(es).

Core.ScriptResult.endpoint_status string

Endpoint connectivity status.

Core.ScriptResult.domain string

Endpoint domain.

Core.ScriptResult.execution_status string

Per-endpoint script execution status.

Core.ScriptResult.return_value unknown

Script return value.

Core.ScriptResult.standard_output string

Script standard output.

Core.ScriptResult.retrieved_files number

Number of files retrieved from the endpoint.

Core.ScriptResult.failed_files number

Number of files that failed to be retrieved.

Core.ScriptResult.retention_date unknown

Result retention date.

Core.ScriptResult.command string

Dynamic command name.

Core.ScriptResult.command_output unknown

Dynamic command output.

getScriptExecutionResultFiles

---

Retrieves the files retrieved from a specific endpoint after running a script. Returns a single zip file entry; no context output.

Arguments

Argument Name	Description	Required
action_id	The action ID retrieved from the runScript command.	Required
endpoint_id	The endpoint ID. To retrieve a list of endpoint IDs, run the getEndpoints command.	Required

Outputs

There are no outputs for this command.

getScriptExecutionStatus

---

Retrieves the status of a script execution action.

Arguments

Argument Name	Description	Required
action_ids	A comma-separated list of the action IDs returned from the runScript / runSnippetCodeScript commands.	Required

Outputs

Core.ScriptStatus.action_id number

Numeric action ID echoed from the request.

Core.ScriptStatus.endpoints_canceled number

Number of endpoints with canceled script executions.

Core.ScriptStatus.endpoints_expired number

Number of endpoints with expired script executions.

Core.ScriptStatus.endpoints_failed number

Number of endpoints with failed script executions.

Core.ScriptStatus.endpoints_in_progress number

Number of endpoints with in-progress script executions.

Core.ScriptStatus.endpoints_pending number

Number of endpoints with pending script executions.

Core.ScriptStatus.endpoints_pending_abort number

Number of endpoints whose script executions are pending abort.

Core.ScriptStatus.endpoints_succeeded number

Number of endpoints with succeeded script executions.

Core.ScriptStatus.endpoints_timeout number

Number of endpoints with timed-out script executions.

Core.ScriptStatus.general_status string

Overall status of the action across all endpoints.

runScriptExecuteCommands

---

Executes shell commands (bash/native or PowerShell) on selected endpoints. Use command_type=powershell for Windows PowerShell commands. Results are returned in the Standard Output field.

Note: This is a polling command.

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command.	Optional
commands	A comma-separated list of shell commands to execute.	Optional
is_raw_command	Whether to pass the command as-is without splitting by commas. Possible values are: true, false.	Optional
command_type	The type of shell command. Possible values are: powershell, native.	Optional
timeout	The timeout in seconds for this execution. Default is 600.	Optional
case_id	Links the response action to the case that triggered it.	Optional
interval_in_seconds	Interval in seconds between each poll.	Optional
timeout_in_seconds	Polling timeout in seconds.	Optional

Outputs

Core.ScriptRun.action_id number

The action ID of the script execution.

Core.ScriptRun.endpoints_count number

Number of endpoints the script was sent to.

runScriptFileExists

---

Checks whether one or more files exist on selected endpoints. Results are returned in the Command Output field (true if exists, false if not found).

Note: This is a polling command.

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command.	Optional
file_path	A comma-separated list of file paths to check.	Optional
timeout	The timeout in seconds for this execution. Default is 600.	Optional
case_id	Links the response action to the case that triggered it.	Optional
interval_in_seconds	Interval in seconds between each poll.	Optional
timeout_in_seconds	Polling timeout in seconds.	Optional

Outputs

Core.ScriptRun.action_id number

The action ID of the script execution.

Core.ScriptRun.endpoints_count number

Number of endpoints the script was sent to.

runScriptDeleteFile

---

Deletes one or more files by path on selected endpoints. Results are returned in the Command Output field (true if deleted, false if not found).

Note: This is a polling command.

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command.	Optional
file_path	A comma-separated list of file paths to delete.	Optional
timeout	The timeout in seconds for this execution. Default is 600.	Optional
case_id	Links the response action to the case that triggered it.	Optional
interval_in_seconds	Interval in seconds between each poll.	Optional
timeout_in_seconds	Polling timeout in seconds.	Optional

Outputs

Core.ScriptRun.action_id number

The action ID of the script execution.

Core.ScriptRun.endpoints_count number

Number of endpoints the script was sent to.

runScriptKillProcess

---

Kills one or more running processes by name on selected endpoints. Results are returned in the Standard Output field (e.g., 'Processes with name X found: 1 killed: 1').

Note: This is a polling command.

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command.	Optional
process_name	A comma-separated list of process names to kill.	Optional
timeout	The timeout in seconds for this execution. Default is 600.	Optional
case_id	Links the response action to the case that triggered it.	Optional
interval_in_seconds	Interval in seconds between each poll.	Optional
timeout_in_seconds	Polling timeout in seconds.	Optional

Outputs

Core.ScriptRun.action_id number

The action ID of the script execution.

Core.ScriptRun.endpoints_count number

Number of endpoints the script was sent to.

runSnippetCodeScript

---

Executes arbitrary Python code on selected endpoints. Use this for quick ad-hoc Python execution without needing a pre-built script. Results are returned in the Command Output field.

Note: This is a polling command.

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command.	Optional
snippet_code	A snippet of Python script code to execute on the target endpoints.	Optional
case_id	Links the response action to the case that triggered it.	Optional
interval_in_seconds	Interval in seconds between each poll.	Optional
timeout_in_seconds	Polling timeout in seconds.	Optional

Outputs

Core.ScriptRun.action_id number

The action ID of the script execution.

Core.ScriptRun.endpoints_count number

Number of endpoints the script was sent to.

scriptRun

---

Runs any script from the XDR script library by UID with custom parameters. Use getScripts to find available scripts and their UIDs. Results vary by script and are returned in Standard Output or Command Output.

Arguments

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs. Can be retrieved by running the core-get-endpoints command.	Required
script_uid	Unique identifier of the script. Can be retrieved by running the core-get-scripts command.	Required
parameters	Dictionary containing the parameter name as key and its value for this execution.	Optional
timeout	The timeout in seconds for this execution. Default is 600.	Optional
case_id	Links the response action to the case that triggered it.	Optional
polling_interval_in_seconds	Interval in seconds between each poll. Default is 10.	Optional
polling_timeout_in_seconds	Polling timeout in seconds. Default is 600.	Optional

Outputs

Core.ScriptResult.action_id number

Action identifier of the script execution.

Core.ScriptResult.endpoint_id string

Endpoint identifier.

Core.ScriptResult.endpoint_name string

Endpoint hostname.

Core.ScriptResult.endpoint_ip_address unknown

Endpoint IP address(es).

Core.ScriptResult.endpoint_status string

Endpoint connectivity status.

Core.ScriptResult.domain string

Endpoint domain.

Core.ScriptResult.execution_status string

Per-endpoint script execution status.

Core.ScriptResult.return_value unknown

Script return value.

Core.ScriptResult.standard_output string

Script standard output.

Core.ScriptResult.retrieved_files number

Number of files retrieved from the endpoint.

Core.ScriptResult.failed_files number

Number of files that failed to be retrieved.

Core.ScriptResult.retention_date unknown

Result retention date.

Core.ScriptResult.command string

Dynamic command name.

Core.ScriptResult.command_output unknown

Dynamic command output.