> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/generic-commands.md).

# Generic commands

The Cortex XSIAM platform supports hundreds of integrations. Among similar integrations, some commands can be generalized to enable combining data from various sources or running integrations in parallel.

For example, reputation commands such as `!file` can gather reputation from multiple connected integrations to one indicator.

These commands can be used on all integrations or with the `using` parameter on specific integration instances.

**Generic reputation commands**

Cortex XSIAM supports many integrations with reputation providers, for example, VirusTotal, AlienVault OTX, and MISP. Every integration that returns a reputation about an indicator must implement the generic reputation commands and calculate a [DBot Score](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/reputation-and-dbot-score.md).

When creating commands that enrich indicators, the commands should be named according to the indicator, such as `!ip` and `!domain`. This naming convention allows commands from multiple integrations to be run together to enrich an indicator. For example, running `!ip ip=8.8.8.8` can trigger multiple integrations that gather information about the IP address.

The recommended way to return indicator context is using one of the classes under `Common` (`Common.IP`, `Common.URL`). For more information, see Return IP Reputation in [Context and outputs](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/context-and-outputs.md). An example of returning indicators is the [IPinfo v2](https://cortex.marketplace.pan.dev/marketplace/details/ipinfo/) integration.

The following are available generic reputation commands.

<details>

<summary>file</summary>

Runs reputation on files.

```programlisting
- name: file
   arguments:
   - name: file
     default: true
     description: List of files.
     isArray: true
```

</details>

<details>

<summary>ip</summary>

Runs reputation on IPs.

```programlisting
- name: ip
   arguments:
   - name: ip
     default: true
     description: List of IPs.
     isArray: true
```

</details>

<details>

<summary>url</summary>

Runs reputation on URLs.

```programlisting
- name: url
   arguments:
   - name: url
     default: true
     description: List of URLs.
     isArray: true
```

</details>

<details>

<summary>domain</summary>

Runs reputation on domains.

```programlisting
- name: domain
   arguments:
   - name: domain
     default: true
     description: List of domains.
     isArray: true
```

</details>

<details>

<summary>email</summary>

Runs reputation on emails.

```programlisting
- name: email
   arguments:
   - name: email
     default: true
     description: List of emails.
     isArray: true
```

</details>

<details>

<summary>cve</summary>

Runs reputation on CVEs.

```programlisting
- name: cve
   arguments:
   - name: cve
     default: true
     description: List of CVEs.
     isArray: true
```

</details>

**Generic endpoint command**

Cortex XSIAM supports many integrations with endpoint providers, for example, GuardiCoreV2.

The following is the generic endpoint command.

**endpoint**

Returns information about an endpoint.

```programlisting
- name: endpoint
   arguments:
   - default: false
     description: The endpoint ID.
     isArray: false
     name: id
     required: false
     secret: false
    - default: true
     description: The endpoint IP address.
     isArray: false
     name: ip
     required: false
     secret: false
    - default: false
     description: The endpoint hostname.
     isArray: false
     name: hostname
     required: false
     secret: false
    deprecated: false
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/generic-commands.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.