> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/graph-commands.md).

# graph commands

Use the content graph commands to create, load, and manage a graph database representation of the content repository. This enables you to visualize content metadata and the relationships between content packs, including dependencies.

<details>

<summary>Architecture</summary>

The database is implemented with the [Neo4j](https://neo4j.com/) platform, and populated with data using the [Neo4j Python driver](https://neo4j.com/docs/api/python-driver/current/api.html). In the database, every content object has a unique node which contains its properties. Nodes of content objects that are associated with each other (for example, playbook A uses script B) have a directed relationship between them that is represented in the graph.

![](/files/WnGYkzpVEiPOLRDyapG5)

*Content Graph Architecture*

#### Docker

These commands start a Neo4j service on Docker by default. The Docker application should be running on the machine, and the service is configured automatically.

</details>

<details>

<summary>create</summary>

{% hint style="info" %}

### Note

The `graph create` command replaces the former `create-content-graph` command.
{% endhint %}

This command creates a content graph from a given content repository. The `create graph` command parses all content packs under the repository, including their relationships. The parsed content objects are then mapped to a repository model and uploaded to the database. When the graph creation is completed, it is available at `http://localhost:7474`. The username is `neo4j` and the password is `contentgraph`.

| Argument                        | Description                                                                                                                                    |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| `-o, --output-path`             | Output folder to save the zip file of the graph exported files.                                                                                |
| `-mp, --marketplace`            | The marketplace to generate the graph for. The default value is xsoar. Other options are marketplacev2, xspanse, xsoar\_saas, xsoar\_on\_prem. |
| `-nd, --no-dependencies`        | Whether dependencies should be included in the graph.                                                                                          |
| `-clt, --console-log-threshold` | Minimum logging threshold for the console logger. Default value is `INFO`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.            |
| `-flt, --file-log-threshold`    | Minimum logging threshold for the file logger. Default value is `DEBUG`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.              |
| `-lp, --log-file-path`          | Path to the log file. Default path is `<CONTENT_PATH>/demisto_sdk_debug.log`.                                                                  |

#### Example

`demisto-sdk graph create --marketplace marketplacev2 --no-dependencies`

Creates a graph based on the XSIAM marketplace, not including dependencies.

</details>

<details>

<summary>update</summary>

{% hint style="info" %}

### Note

The `update create` command replaces the former `update-content-graph` command.
{% endhint %}

Updates the content graph from the official content graph. This command downloads the official content graph, imports it locally, and updates it with the changes in the given repository or by the `--packs` argument. If you use the `--packs` argument, only the specified packs are parsed again and re-uploaded to the graph. When the graph update is complete, it is available at `http://localhost:7474`. The username is `neo4j` and the password is `contentgraph`.

| Argument                        | Description                                                                                                                                                              |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-g, --use-git`                 | If set to `true`, uses Git to determine which packs to update. The default is `FALSE`, but is automatically considered `TRUE` if the `--imported-path` is not specified. |
| `-mp, --marketplace`            | The marketplace to generate the graph for. The default value is `xsoar`. Other options are `marketplacev2`, `xspanse`, `xsoar_saas`, and `xsoar_on_prem`.                |
| `-i, --imported-path`           | Path to a content graph .zip file to import. The default is `None`.                                                                                                      |
| `-p, --packs`                   | A comma-separated list of packs to update. By default, the value is `None` and the entire content repository is used if no packs are specified.                          |
| `-nd, --no-dependencies`        | Indicates whether dependencies should be included in the graph. The default is `FALSE`, because dependencies are calculated by default.                                  |
| `-o, --output-path`             | Output folder to save the .zip file of the graph exported files.                                                                                                         |
| `-clt, --console-log-threshold` | Minimum logging threshold for the console logger. Default value is `INFO`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.                                      |
| `-flt, --file-log-threshold`    | Minimum logging threshold for the file logger. Default value is `DEBUG`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.                                        |
| `-lp, --log-file-path`          | Path to the log file. Default path is `<CONTENT_PATH>/demisto_sdk_debug.log`.                                                                                            |

#### Example

`demisto-sdk graph update --marketplace marketplacev2 -packs Jira -i path/to/file.zip -o path/to/output/dir`

Imports an XSIAM graph from `file.zip`, updates the Jira pack, and outputs the new file to the `dir` directory.

</details>

<details>

<summary>get-relationships</summary>

This command returns the relationships for a given content object.

| Argument                        | Description                                                                                                                                           |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `input`                         | The path to a content item or a content pack. (Required)                                                                                              |
| `-ct, --content-type`           | The content type of the related object. Example: `-ct Playbook` .                                                                                     |
| `-d. --depth`                   | Maximum depth (length) of the relationship paths. The default value is 1. Possible values are between 1 and 5, inclusive.                             |
| `-nu, --no-update-graph`        | If provided, does not run an update on the graph before querying. If you do not include this argument, the update is run.                             |
| `-mp, --marketplace`            | The marketplace to generate the graph for. The default value is `xsoar`. Other options are `marketplacev2`, `xspanse`, `xsoar_saas`, `xsoar_on_prem`. |
| `--mandatory-only`              | If set to `True`, returns only mandatory relationships. This is relevant only for `DEPENDS_ON/USES` relationships.                                    |
| `--include-tests`               | If set to `True`, includes tests in outputs. This is relevant only for `DEPENDS_ON/USES` relationships.                                               |
| `--include-deprecated`          | If set to `True`, includes deprecated content items in outputs.                                                                                       |
| `--include-hidden`              | If set to `True`, includes hidden packs in outputs. This is relevant only for `DEPENDS_ON/USES` relationships.                                        |
| `-dir, --direction`             | Specifies whether to return only sources, only targets or both. The default is `both`. Possible values are `sources`, `targets`, or `both`.           |
| `-o, --output-path`             | Output folder to save the file to.                                                                                                                    |
| `-clt, --console-log-threshold` | Minimum logging threshold for the console logger. Default value is `INFO`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.                   |
| `-flt, --file-log-threshold`    | Minimum logging threshold for the file logger. Default value is `DEBUG`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.                     |
| `-lp, --log-file-path`          | Path to the log file. Default path is `<CONTENT_PATH>/demisto_sdk_debug.log`.                                                                         |

#### Examples

* `demisto-sdk graph get-relationships Packs/SplunkPy/Integrations/SplunkPy/SplunkPy.yml`

  Returns all content items that either use or are being used by the SplunkPY integration directly.
* `demisto-sdk graph get-relationships Packs/Jira -d 5 --relationship depends_on --mandatory-only --direction targets`

  Returns the full-level dependencies of the Jira pack in Cortex XSOAR, but only mandatory dependencies, and excludes hidden packs or test dependencies.

</details>

<details>

<summary>get-dependencies</summary>

This command returns the dependencies for a given content pack.

{% hint style="info" %}

### Note

* The **`get-dependencies`** command dynamically determines the actual dependencies. The dependency list found in the pack metadata is not the source of truth; it is only used for hardening.
* The **`get-dependencies`** command intentionally excludes the `ApiModules` pack from its results. Unlike standard dependencies, ApiModules scripts are copied and imported directly during content preparation.
* You can generate graphs for custom packs as long as they are maintained in a properly formatted content repository, such as a fork of the official repository.
  {% endhint %}

| Argument                         | Description                                                                                                                                                          |
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `pack`                           | The ID of the pack to check dependencies for. (Required)                                                                                                             |
| `-sr, --show-reasons/--`         | This flag prints all of the relationships between the given content pack and its dependencies. The default is not to print these relationships.                      |
| `-d, --dependency`               | Get the data for a specific dependency pack ID.                                                                                                                      |
| `-mp, --marketplace`             | The marketplace to generate the graph for. The default value is `xsoar`. Other options are `marketplacev2`, `xspanse`, `xsoar_saas`, `xsoar_on_prem`.                |
| `-m, --mandatory-only`           | This flag returns only mandatory dependencies.                                                                                                                       |
| `-ald, --all-level-dependencies` | This flag retrieves all levels of dependencies.                                                                                                                      |
| `--include-test-dependencies`    | This flag includes test dependencies in outputs.                                                                                                                     |
| `--include-hidden`               | This flag includes hidden packs in outputs.                                                                                                                          |
| `-dir, --direction`              | Specifies whether to return only sources, only targets or both sides of dependencies. The default is `targets`. Possible values are `sources`, `targets`, or `both`. |
| `-nu, --no-update-graph`         | If provided, does not run an update on the graph before querying. If you do not include this argument, the update is run.                                            |
| `-o, --output`                   | Output folder to save the file to.                                                                                                                                   |
| `-clt, --console-log-threshold`  | Minimum logging threshold for the console logger. Default value is `INFO`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.                                  |
| `-flt, --file-log-threshold`     | Minimum logging threshold for the file logger. Default value is `DEBUG`. Possible values are `DEBUG`, `INFO`, `WARNING`, `ERROR`.                                    |
| `-lp, --log-file-path`           | Path to the log file. Default path is `<CONTENT_PATH>/demisto_sdk_debug.log`.                                                                                        |

#### Examples

* `demisto-sdk graph get-dependencies SplunkPy -sr`

  Returns the dependencies for the SplunkPY content pack and prints its relationships.
* `demisto-sdk graph get-dependencies Campaign -sr --include-test-dependencies --include-hidden -ald -m`

  Returns the dependencies for the Campaign content pack, prints its relationships, including test and hidden pack dependencies.
* `demisto-sdk graph get-dependencies Campaign -sr -ald -m -dir both`

  Returns the source and target all level dependencies for the Campaign content pack, prints only mandatory relationships.
* `demisto-sdk graph get-dependencies Campaign -sr -dir both -d Phishing`

  Returns the source and target dependencies for the Campaign content pack only for the Phishing content pack dependency.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/graph-commands.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.