> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md).

# Integration commands in the CLI

The command line interface (CLI) enables you to run system commands, integration commands, scripts, and more from the CLI. The CLI auto-complete feature allows you to find relevant commands, scripts, and arguments.

Cortex XSOAR uses the following commands:

* System commands: These commands are not specific to an integration. System commands are entered in the CLI using a "`/`". For example, `/clear_playground`.
* External commands: These commands are specific to an integration and perform actions relating to a specific integration, using "`!`". For example, `!xdr-get-alerts`.

Go to **Settings & Info** → Settings+Integrations → **Instances**, under each integration, you can view a list of commands.

{% hint style="info" %}

### Note

Integration commands are only available when the integration instance is enabled. Some commands depend on a successful connection between Cortex XSOAR and third-party integrations.
{% endhint %}

You can run the CLI commands on any page where the CLI appears or in an incident. If run on a page not in an incident, the results are returned to the Playground. The Playground is a non-production environment where you can safely develop and test automation scripts, APIs, commands, and more. It is an investigation area that is not connected to a live (active) investigation.

In the following example, set up the **Palo Alto Networks Cortex XDR - Investigation and Response** integration instance. To retrieve Cortex XDR incidents, for the last year, sort by time in ascending order and limit to 5 incidents type the following in the CLI:

`!xdr-get-incidents limit = 5 since_creation_time="1 year" sort_by_creation_time=asc`

In the Playground, you can see the list of incidents in a markdown table.

To see the incidents in a JSON format, select **Side Panels** → **Context Data**. Each incident contains information obtained from the Cortex XDR endpoint that can be used in subsequent commands. You can search for a field such as `incident_id`. To get more information about the `incident_id:1`, copy the data, by clicking the`incident_id`in the context sata.

![cli-contextdata.png](/files/xUiTfCe7TK9VsatpqQCD)

To retrieve additional data from `incident _id`:

`!xdr-get-incident-extra-data incident_id ${value copied from context data}`

For example `!xdr-get-incident-extra-data incident_id ${PaloAltoNetworksXDR.Incident.[0].incident.id}`

You can then see additional information.

![cli-contextdata2.png](/files/YU8OooRODUP3gJOr5rBZ)

{% hint style="info" %}

### Tip

In the Playground, you can clear the context data, if needed, which deletes everything in the Playground context data, but does not affect the actual incident. To clear the context, run `!DeleteContext all=yes'` from the CLI or click **Clear Context Data** while viewing the context data.

To erase a playground and create a new one, run the `/playground_create` command.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.