> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/entry.md).

# Entry

APIs for managing entries to the War Room

## Create new entry in existing investigation

> API to create an entry (markdown format) in existing investigation\
> Body example: {"investigationId":"1234","data":"entry content…"}

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"updateEntry":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntry"}},"application/xml":{"schema":{"$ref":"#/components/schemas/updateEntry"}}}}},"schemas":{"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"},"markdown":{"type":"boolean"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"Entry":{"type":"object","description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"reputations":{"type":"array","description":"EntryReputations the reputations calculated by regex match","items":{"$ref":"#/components/schemas/EntryReputation"}},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"IndicatorTimeline":{"type":"array","title":"IndicatorTimeline ...","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."},"APIExecutionMetric":{"type":"object","description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}}},"EntryCategory":{"type":"string","title":"EntryCategory ..."},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","description":"EntryTask holds information regarding the related task","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}}},"FileMetadata":{"type":"object","title":"FileMetadata ...","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"type":"object","title":"EntryHistory ...","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"EntryReputation":{"type":"object","description":"EntryReputation holds the entry reputations and the highlights","properties":{"highlights":{"$ref":"#/components/schemas/FieldTermLocationMap"},"reputationsData":{"type":"array","items":{"$ref":"#/components/schemas/ReputationData"}}}},"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}},"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}},"paths":{"/entry":{"post":{"summary":"Create new entry in existing investigation","description":"API to create an entry (markdown format) in existing investigation\nBody example: {\"investigationId\":\"1234\",\"data\":\"entry content…\"}","operationId":"investigationAddEntryHandler","requestBody":{"$ref":"#/components/requestBodies/updateEntry"},"responses":{"200":{"description":"Entry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Entry"}}}},"412":{"description":"In case of closed investigation"}},"tags":["Entry"]}}}}
```

## Download file

> Download file from Cortex XSOAR by entry ID

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}}},"paths":{"/entry/download/{entryid}":{"get":{"summary":"Download file","description":"Download file from Cortex XSOAR by entry ID","operationId":"downloadFile","parameters":[{"name":"entryid","in":"path","description":"Entry ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Return the entry"}},"tags":["Entry"]}}}}
```

## Create new entry in existing investigation

> API to create an entry (markdown format) in existing investigation\
> Body example: {"investigationId":"1234","data":"entry content…"}

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"updateEntry":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntry"}},"application/xml":{"schema":{"$ref":"#/components/schemas/updateEntry"}}}}},"schemas":{"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"},"markdown":{"type":"boolean"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"Entry":{"type":"object","description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"reputations":{"type":"array","description":"EntryReputations the reputations calculated by regex match","items":{"$ref":"#/components/schemas/EntryReputation"}},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"IndicatorTimeline":{"type":"array","title":"IndicatorTimeline ...","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."},"APIExecutionMetric":{"type":"object","description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}}},"EntryCategory":{"type":"string","title":"EntryCategory ..."},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","description":"EntryTask holds information regarding the related task","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}}},"FileMetadata":{"type":"object","title":"FileMetadata ...","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"type":"object","title":"EntryHistory ...","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"EntryReputation":{"type":"object","description":"EntryReputation holds the entry reputations and the highlights","properties":{"highlights":{"$ref":"#/components/schemas/FieldTermLocationMap"},"reputationsData":{"type":"array","items":{"$ref":"#/components/schemas/ReputationData"}}}},"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}},"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}},"paths":{"/entry/execute/sync":{"post":{"summary":"Create new entry in existing investigation","description":"API to create an entry (markdown format) in existing investigation\nBody example: {\"investigationId\":\"1234\",\"data\":\"entry content…\"}","operationId":"investigationAddEntriesSync","requestBody":{"$ref":"#/components/requestBodies/updateEntry"},"responses":{"200":{"description":"An array of the children entries of the executed entry.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Entry"}}}}},"412":{"description":"In case of closed investigation"}},"tags":["Entry"]}}}}
```

## Export Artifact

> Export an entry artifact

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"DownloadEntry":{"type":"object","title":"DownloadEntry ...","properties":{"id":{"type":"string"},"investigationId":{"type":"string"}}}}},"paths":{"/entry/exportArtifact":{"post":{"summary":"Export Artifact","description":"Export an entry artifact","operationId":"entryExportArtifact","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DownloadEntry"}},"application/xml":{"schema":{"$ref":"#/components/schemas/DownloadEntry"}}}},"responses":{"200":{"description":"created file name"}},"tags":["Entry"]}}}}
```

## Create new formatted entry in existing investigation

> API to create a formatted entry (table/json/text/markdown/html) in existing investigation\
> Body example: {"investigationId":"1234","format":"table/json/text/markdown/html","contents":"entry content…"}

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"uploadedEntry":{"type":"object","properties":{"contents":{"type":"string"},"format":{"type":"string"},"investigationId":{"type":"string"}}},"Entry":{"type":"object","description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"reputations":{"type":"array","description":"EntryReputations the reputations calculated by regex match","items":{"$ref":"#/components/schemas/EntryReputation"}},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"IndicatorTimeline":{"type":"array","title":"IndicatorTimeline ...","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."},"APIExecutionMetric":{"type":"object","description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}}},"EntryCategory":{"type":"string","title":"EntryCategory ..."},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","description":"EntryTask holds information regarding the related task","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}}},"FileMetadata":{"type":"object","title":"FileMetadata ...","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"type":"object","title":"EntryHistory ...","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"EntryReputation":{"type":"object","description":"EntryReputation holds the entry reputations and the highlights","properties":{"highlights":{"$ref":"#/components/schemas/FieldTermLocationMap"},"reputationsData":{"type":"array","items":{"$ref":"#/components/schemas/ReputationData"}}}},"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}},"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}},"paths":{"/entry/formatted":{"post":{"summary":"Create new formatted entry in existing investigation","description":"API to create a formatted entry (table/json/text/markdown/html) in existing investigation\nBody example: {\"investigationId\":\"1234\",\"format\":\"table/json/text/markdown/html\",\"contents\":\"entry content…\"}","operationId":"investigationAddFormattedEntryHandler","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/uploadedEntry"}},"application/xml":{"schema":{"$ref":"#/components/schemas/uploadedEntry"}}}},"responses":{"200":{"description":"Entry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Entry"}}}}},"tags":["Entry"]}}}}
```

## Mark entry as note

> API to mark entry as note, can be used also to remove the note\
> Body example: {"id":1\\@1234","version":"-1","investigationId":"1234","data":"true/false"}

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"requestBodies":{"updateEntry":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntry"}},"application/xml":{"schema":{"$ref":"#/components/schemas/updateEntry"}}}}},"schemas":{"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"},"markdown":{"type":"boolean"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"Entry":{"type":"object","description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"reputations":{"type":"array","description":"EntryReputations the reputations calculated by regex match","items":{"$ref":"#/components/schemas/EntryReputation"}},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"IndicatorTimeline":{"type":"array","title":"IndicatorTimeline ...","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."},"APIExecutionMetric":{"type":"object","description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}}},"EntryCategory":{"type":"string","title":"EntryCategory ..."},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","description":"EntryTask holds information regarding the related task","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}}},"FileMetadata":{"type":"object","title":"FileMetadata ...","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"type":"object","title":"EntryHistory ...","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"EntryReputation":{"type":"object","description":"EntryReputation holds the entry reputations and the highlights","properties":{"highlights":{"$ref":"#/components/schemas/FieldTermLocationMap"},"reputationsData":{"type":"array","items":{"$ref":"#/components/schemas/ReputationData"}}}},"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}},"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}},"paths":{"/entry/note":{"post":{"summary":"Mark entry as note","description":"API to mark entry as note, can be used also to remove the note\nBody example: {\"id\":1\\@1234\",\"version\":\"-1\",\"investigationId\":\"1234\",\"data\":\"true/false\"}","operationId":"updateEntryNote","requestBody":{"$ref":"#/components/requestBodies/updateEntry"},"responses":{"200":{"description":"Entry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Entry"}}}}},"tags":["Entry"]}}}}
```

## Set entry tags

> API to set entry tags\
> Body example: {"id":"1\\@1234","version":"-1","investigationId":"1234","tags":\["tag1","tag2"]"}

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://hostname"}],"security":[{"api_key":[]}],"components":{"securitySchemes":{"api_key":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"updateEntryTags":{"type":"object","properties":{"id":{"type":"string"},"investigationId":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"tags":{"type":"array","items":{"type":"string"}},"version":{"type":"integer","format":"int64"}}},"Entry":{"type":"object","description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"reputations":{"type":"array","description":"EntryReputations the reputations calculated by regex match","items":{"$ref":"#/components/schemas/EntryReputation"}},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"IndicatorTimeline":{"type":"array","title":"IndicatorTimeline ...","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."},"APIExecutionMetric":{"type":"object","description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}}},"EntryCategory":{"type":"string","title":"EntryCategory ..."},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","description":"EntryTask holds information regarding the related task","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}}},"FileMetadata":{"type":"object","title":"FileMetadata ...","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"type":"object","title":"EntryHistory ...","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"EntryReputation":{"type":"object","description":"EntryReputation holds the entry reputations and the highlights","properties":{"highlights":{"$ref":"#/components/schemas/FieldTermLocationMap"},"reputationsData":{"type":"array","items":{"$ref":"#/components/schemas/ReputationData"}}}},"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}},"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}},"paths":{"/entry/tags":{"post":{"summary":"Set entry tags","description":"API to set entry tags\nBody example: {\"id\":\"1\\@1234\",\"version\":\"-1\",\"investigationId\":\"1234\",\"tags\":[\"tag1\",\"tag2\"]\"}","operationId":"updateEntryTagsOp","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntryTags"}},"application/xml":{"schema":{"$ref":"#/components/schemas/updateEntryTags"}}}},"responses":{"200":{"description":"Entry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Entry"}}}}},"tags":["Entry"]}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/entry.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.