download

Download and merge custom content from Cortex XSOAR or Cortex XSIAM into a local repository.

Downloads and merges content from a Cortex XSOAR or Cortex XSIAM tenant to your local repository. Set up the required environment variables prior to running this command in order to establish a connection between Demisto SDK and the tenant.

This command is useful when developing within the Cortex tenant itself and downloading the new entities to your local environment in order to continue with the contribution process.

The download command requires interactions with Cortex XSOAR or Cortex XSIAM. Before you use the command, verify you have set up the environment variables.

Notes and Limitations

• The download is one-directional; data goes from the server to the repository.
• JavaScript integrations and scripts are not downloadable using this command.
• If there are files that exist both in the output directory and are specified in the input, they are ignored. To override this behavior so that existing files are merged with their newer version, use the --force/-f flag.
• For consistency, we assume that for each integration or script, the folder containing it has the same name as the integration/script name with no separators. For example, the integration Test Integration_Full-Name is under ~/.../Packs/TestPack/Integrations/TestIntegrationFullName/.
• Integrations, scripts, and playbook directories that do not contain a YAML file are overwritten automatically. All other folders that do not contain a JSON file are overwritten automatically. To keep things clear and consistent, the given pack should be consistent with the content hierarchy structure with no rogue files present.
• The SDK assumes the following playbooks as TestPlaybook type.

  • Playbooks with names that start with Test, Test_, test_, Test-, or test- .
  • Playbooks with names that end with Test,_test or -test.

Arguments

-o PACK_PATH, --output PACK_PATH	The path of a package directory to download custom content to.
-i "file_name_1" ... -i "file_name_n", --input "file_name_1" ... --input "file_name_n"	The custom content file name to be downloaded. Can be provided multiple times. File names can be retrieved using the -lf flag.
-lf, --list-files	Prints a list of all custom content files available for download.
-a, --all-custom-content	Downloads all available custom content files.
-fmt, --run-format	Whether to run Demisto SDK formatting on downloaded files.
-f, --force	Whether to overwrite existing files.
--insecure	Skips certificate validation.
-r, --regex	Regex pattern. When specified, downloads all the custom content files with a name that matches the regex pattern.
--system	Downloads system items.
--it, --item-type	The item types to download. Use only when downloading system items.
--auto-replace-uuids / --no-auto-replace-uuids	If false, prevents UUID replacements when downloading using the download command. The default is true.
--init	Initializes the output directory with a pack structure.
--keep-empty-folders	Keeps empty folders when a pack structure is initialized.

Supported File Types

• Integrations
• Beta integrations
• Scripts
• Playbooks
• Test playbooks
• Reports
• Dashboards
• Widgets
• Incident fields
• Indicator fields
• Incident types
• Layouts
• Classifiers
• Lists

Note

Bear in mind:

• Integrations/scripts written in JavaScript are not supported.
• A playbook starting with the word Test is downloaded as a test playbook.

Examples

• demisto-sdk download -o Packs/TestPack -i "Test Integration" -i "TestScript" -i "TestPlaybook"

  Downloads the integration Test Integration, script TestScript, and playbook TestPlaybook only if they don't exist in the output pack.
• demisto-sdk download -o Packs/TestPack -i "Test Integration" -i "TestScript" -i "TestPlaybook" -f

  Downloads the integration Test Integration, script TestScript, and playbook TestPlaybook. If one of the files exists in the output pack, only its changes from the Cortex XSOAR instance are merged into the existing file. If the file doesn't exist in the output pack, it is copied completely from the Cortex XSOAR instance.
• demisto-sdk download -o Packs/TestPack -a

  Downloads all available custom content to the output pack; -i / --input should not be provided.
• demisto-sdk download -lf

  Prints the list of all custom content files available to be downloaded from the Cortex XSOAR instance; -i / --input and -o / --output should not be provided.
• demisto-sdk download -r *Phishing*

  Regex pattern. When specified, downloads all custom content files with a name that matches this regex pattern; -o / --output should not be provided.
• demisto-sdk download --system -it IncidentType -i "Authentication" -i "Access" -o Packs/ABCD

  Downloads system items. Provide the item type and the item name as input.