> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/models.md).

# Models

## The automationScriptFilterWrapper object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"automationScriptFilterWrapper":{"type":"object","title":"automationScriptFilterWrapper ...","properties":{"filter":{"$ref":"#/components/schemas/GenericStringFilter"},"savePassword":{"type":"boolean"},"script":{"$ref":"#/components/schemas/AutomationScript"}}},"GenericStringFilter":{"type":"object","description":"GenericStringFilter is a general filter that will fetch entities using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"AutomationScript":{"type":"object","description":"AutomationScript represents a script that will run on  the system","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","description":"This fields indicates which commands this script depends on","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"EngineInfo":{"type":"object","title":"EngineInfo ...","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}}
```

## The GenericStringFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"GenericStringFilter":{"type":"object","description":"GenericStringFilter is a general filter that will fetch entities using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The Order object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The AutomationScript object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"AutomationScript":{"type":"object","description":"AutomationScript represents a script that will run on  the system","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","description":"This fields indicates which commands this script depends on","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"EngineInfo":{"type":"object","title":"EngineInfo ...","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}}
```

## The EngineInfo object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EngineInfo":{"type":"object","title":"EngineInfo ...","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}}}}}
```

## The Argument object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."}}}}
```

## The ArgumentType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ArgumentType":{"type":"string","title":"ArgumentType ..."}}}}
```

## The Version object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}}}}}
```

## The Important object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}}}}}
```

## The Output object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."}}}}
```

## The OutputType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"OutputType":{"type":"string","title":"OutputType ..."}}}}
```

## The ScriptTarget object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"}}}}
```

## The ScriptSubType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"}}}}
```

## The Duration object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The ScriptType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}}
```

## The automationScriptResult object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"automationScriptResult":{"type":"object","title":"automationScriptResult ...","properties":{"pythonEnabled":{"type":"boolean"},"scripts":{"type":"array","items":{"$ref":"#/components/schemas/ScriptAPI"}},"selectedScript":{"type":"object","additionalProperties":{"type":"object"}},"suggestions":{"type":"array","items":{"type":"string"}}}},"ScriptAPI":{"type":"object","title":"ScriptAPI ...","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"comment":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"hidden":{"type":"boolean"},"id":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"roles":{"type":"array","items":{"type":"string"}},"runAs":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}}
```

## The ScriptAPI object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ScriptAPI":{"type":"object","title":"ScriptAPI ...","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"comment":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"hidden":{"type":"boolean"},"id":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"roles":{"type":"array","items":{"type":"string"}},"runAs":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}}
```

## The automationScriptFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"automationScriptFilter":{"type":"object","description":"automationScriptFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"stripContext":{"type":"boolean"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The InstanceClassifier object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InstanceClassifier":{"type":"object","description":"InstanceClassifier - classifies an incident from a specific brand","properties":{"brands":{"type":"array","items":{"type":"string"}},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"defaultIncidentType":{"type":"string"},"definitionId":{"type":"string"},"description":{"type":"string"},"feed":{"type":"boolean"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentSamples":{"$ref":"#/components/schemas/Incidents"},"indexName":{"type":"string"},"indicatorSamples":{"$ref":"#/components/schemas/FeedIndicators"},"instanceIds":{"type":"array","items":{"type":"string"}},"itemVersion":{"$ref":"#/components/schemas/Version"},"keyTypeMap":{"type":"object","additionalProperties":{"type":"string"}},"locked":{"type":"boolean"},"logicalVersion":{"type":"integer","format":"int64"},"mapping":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Mapper"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"nameRaw":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceClassifierId":{"type":"string"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"transformer":{"$ref":"#/components/schemas/AdvanceArg"},"type":{"$ref":"#/components/schemas/MapperType"},"unclassifiedCases":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/UnclassifiedCases"}},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Incidents":{"description":"Incidents is a list of incident entities"},"FeedIndicators":{"type":"array","title":"FeedIndicators ...","items":{"$ref":"#/components/schemas/FeedIndicator"}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."},"Mapper":{"type":"object","description":"Mapper - mapper for new incidents","properties":{"dontMapEventToLabels":{"type":"boolean","description":"DontMapEventToLabels by default we will map all the fields of the event to incident labels"},"internalMapping":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"MapperType":{"type":"string","description":"MapperType for instance classifier"},"UnclassifiedCases":{"type":"object","title":"UnclassifiedCases ...","additionalProperties":{"type":"integer","format":"int64"}}}}}
```

## The Incidents object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Incidents":{"description":"Incidents is a list of incident entities"}}}}
```

## The FeedIndicators object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FeedIndicators":{"type":"array","title":"FeedIndicators ...","items":{"$ref":"#/components/schemas/FeedIndicator"}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The FeedIndicator object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The ExpirationSource object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."}}}}
```

## The ExpirationPolicy object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."}}}}
```

## The ExpirationSettingsSource object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."}}}}
```

## The FeedIndicatorComment object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}}}}}
```

## The CustomFields object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}}}}}
```

## The RelationshipsAPI object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The RelationshipAPI object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The Reliability object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The Mapper object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Mapper":{"type":"object","description":"Mapper - mapper for new incidents","properties":{"dontMapEventToLabels":{"type":"boolean","description":"DontMapEventToLabels by default we will map all the fields of the event to incident labels"},"internalMapping":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The AdvanceArg object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."}}}}
```

## The ComplexArg object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."}}}}
```

## The ArgFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."}}}}
```

## The ArgAtomicFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The OperatorArgument object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The FilterOperatorID object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."}}}}
```

## The ArgTransformer object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The TransformerOperatorID object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."}}}}
```

## The KeyValueArg object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."}}}}
```

## The MapperType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"MapperType":{"type":"string","description":"MapperType for instance classifier"}}}}
```

## The UnclassifiedCases object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"UnclassifiedCases":{"type":"object","title":"UnclassifiedCases ...","additionalProperties":{"type":"integer","format":"int64"}}}}}
```

## The Dashboard object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Dashboard":{"type":"object","title":"Dashboard ...","properties":{"accounts":{"type":"object","additionalProperties":{"type":"object"}},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidePivot":{"type":"boolean"},"hideSearch":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommon":{"type":"boolean"},"itemVersion":{"$ref":"#/components/schemas/Version"},"layout":{"$ref":"#/components/schemas/WidgetCells"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"modulePage":{"type":"boolean"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"owner":{"type":"string"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"period":{"$ref":"#/components/schemas/Period"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"WidgetCells":{"type":"array","title":"WidgetCells ...","items":{"$ref":"#/components/schemas/WidgetCell"}},"WidgetCell":{"type":"object","title":"WidgetCell ...","properties":{"forceRange":{"type":"boolean"},"h":{"type":"integer","format":"int64"},"i":{"type":"string"},"id":{"type":"string"},"reflectDimensions":{"type":"boolean"},"w":{"type":"integer","format":"int64"},"widget":{"$ref":"#/components/schemas/Widget"},"x":{"type":"integer","format":"int64"},"y":{"type":"integer","format":"int64"}}},"Widget":{"type":"object","description":"Widget describe a widget component used to get statistics requests, based on parameters such as\ndataType and widgetType. A widget can be a part of widgets collection inside a dashboard.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","description":"Accounts list of accounts to query the widget data from","additionalProperties":{"type":"object"}},"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string","description":"Category the widget is related to. Used to display in widget library under category or dataType if empty."},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dataType":{"type":"string","description":"Data type of the widget. Describes what data does the widget query. supporting data types \"incidents\",\"messages\",\"system\",\"entries\",\"tasks\", \"audit\"."},"dateRange":{"$ref":"#/components/schemas/DateRange"},"definition":{"$ref":"#/components/schemas/GenericObjectDefinition"},"definitionId":{"type":"string"},"description":{"type":"string","description":"The description of the widget's usage and data representation."},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"indexName":{"type":"string"},"isPredefined":{"type":"boolean","description":"Is the widget a system widget."},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean","description":"Is the widget locked for editing."},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Default name of the widget."},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"params":{"type":"object","description":"Additional parameters for this widget, depends on widget type and data.","additionalProperties":{"type":"object"}},"prevName":{"type":"string","description":"The previous name of the widget."},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"query":{"type":"string","description":"Query to search on the dataType."},"remote":{"type":"boolean"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"skipAggregateAccounts":{"type":"boolean","description":"SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"widgetType":{"type":"string","description":"Widget type describes how does the widget should recieve the data, and display it. Supporting types: \"bar\", \"column\", \"pie\", \"list\", \"number\", \"trend\", \"text\", \"duration\", \"image\", \"line\", and \"table\"."}},"required":["name","widgetType"]},"DateRange":{"type":"object","description":"DateRange provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"GenericObjectDefinition":{"type":"object","title":"GenericObjectDefinition ...","properties":{"auditable":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"definitionId":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"partitioned":{"type":"boolean"},"pluralName":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"rbacSupport":{"type":"boolean"},"remote":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The WidgetCells object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"WidgetCells":{"type":"array","title":"WidgetCells ...","items":{"$ref":"#/components/schemas/WidgetCell"}},"WidgetCell":{"type":"object","title":"WidgetCell ...","properties":{"forceRange":{"type":"boolean"},"h":{"type":"integer","format":"int64"},"i":{"type":"string"},"id":{"type":"string"},"reflectDimensions":{"type":"boolean"},"w":{"type":"integer","format":"int64"},"widget":{"$ref":"#/components/schemas/Widget"},"x":{"type":"integer","format":"int64"},"y":{"type":"integer","format":"int64"}}},"Widget":{"type":"object","description":"Widget describe a widget component used to get statistics requests, based on parameters such as\ndataType and widgetType. A widget can be a part of widgets collection inside a dashboard.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","description":"Accounts list of accounts to query the widget data from","additionalProperties":{"type":"object"}},"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string","description":"Category the widget is related to. Used to display in widget library under category or dataType if empty."},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dataType":{"type":"string","description":"Data type of the widget. Describes what data does the widget query. supporting data types \"incidents\",\"messages\",\"system\",\"entries\",\"tasks\", \"audit\"."},"dateRange":{"$ref":"#/components/schemas/DateRange"},"definition":{"$ref":"#/components/schemas/GenericObjectDefinition"},"definitionId":{"type":"string"},"description":{"type":"string","description":"The description of the widget's usage and data representation."},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"indexName":{"type":"string"},"isPredefined":{"type":"boolean","description":"Is the widget a system widget."},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean","description":"Is the widget locked for editing."},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Default name of the widget."},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"params":{"type":"object","description":"Additional parameters for this widget, depends on widget type and data.","additionalProperties":{"type":"object"}},"prevName":{"type":"string","description":"The previous name of the widget."},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"query":{"type":"string","description":"Query to search on the dataType."},"remote":{"type":"boolean"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"skipAggregateAccounts":{"type":"boolean","description":"SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"widgetType":{"type":"string","description":"Widget type describes how does the widget should recieve the data, and display it. Supporting types: \"bar\", \"column\", \"pie\", \"list\", \"number\", \"trend\", \"text\", \"duration\", \"image\", \"line\", and \"table\"."}},"required":["name","widgetType"]},"DateRange":{"type":"object","description":"DateRange provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"GenericObjectDefinition":{"type":"object","title":"GenericObjectDefinition ...","properties":{"auditable":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"definitionId":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"partitioned":{"type":"boolean"},"pluralName":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"rbacSupport":{"type":"boolean"},"remote":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The WidgetCell object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"WidgetCell":{"type":"object","title":"WidgetCell ...","properties":{"forceRange":{"type":"boolean"},"h":{"type":"integer","format":"int64"},"i":{"type":"string"},"id":{"type":"string"},"reflectDimensions":{"type":"boolean"},"w":{"type":"integer","format":"int64"},"widget":{"$ref":"#/components/schemas/Widget"},"x":{"type":"integer","format":"int64"},"y":{"type":"integer","format":"int64"}}},"Widget":{"type":"object","description":"Widget describe a widget component used to get statistics requests, based on parameters such as\ndataType and widgetType. A widget can be a part of widgets collection inside a dashboard.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","description":"Accounts list of accounts to query the widget data from","additionalProperties":{"type":"object"}},"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string","description":"Category the widget is related to. Used to display in widget library under category or dataType if empty."},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dataType":{"type":"string","description":"Data type of the widget. Describes what data does the widget query. supporting data types \"incidents\",\"messages\",\"system\",\"entries\",\"tasks\", \"audit\"."},"dateRange":{"$ref":"#/components/schemas/DateRange"},"definition":{"$ref":"#/components/schemas/GenericObjectDefinition"},"definitionId":{"type":"string"},"description":{"type":"string","description":"The description of the widget's usage and data representation."},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"indexName":{"type":"string"},"isPredefined":{"type":"boolean","description":"Is the widget a system widget."},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean","description":"Is the widget locked for editing."},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Default name of the widget."},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"params":{"type":"object","description":"Additional parameters for this widget, depends on widget type and data.","additionalProperties":{"type":"object"}},"prevName":{"type":"string","description":"The previous name of the widget."},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"query":{"type":"string","description":"Query to search on the dataType."},"remote":{"type":"boolean"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"skipAggregateAccounts":{"type":"boolean","description":"SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"widgetType":{"type":"string","description":"Widget type describes how does the widget should recieve the data, and display it. Supporting types: \"bar\", \"column\", \"pie\", \"list\", \"number\", \"trend\", \"text\", \"duration\", \"image\", \"line\", and \"table\"."}},"required":["name","widgetType"]},"DateRange":{"type":"object","description":"DateRange provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"GenericObjectDefinition":{"type":"object","title":"GenericObjectDefinition ...","properties":{"auditable":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"definitionId":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"partitioned":{"type":"boolean"},"pluralName":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"rbacSupport":{"type":"boolean"},"remote":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The Widget object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Widget":{"type":"object","description":"Widget describe a widget component used to get statistics requests, based on parameters such as\ndataType and widgetType. A widget can be a part of widgets collection inside a dashboard.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","description":"Accounts list of accounts to query the widget data from","additionalProperties":{"type":"object"}},"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string","description":"Category the widget is related to. Used to display in widget library under category or dataType if empty."},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dataType":{"type":"string","description":"Data type of the widget. Describes what data does the widget query. supporting data types \"incidents\",\"messages\",\"system\",\"entries\",\"tasks\", \"audit\"."},"dateRange":{"$ref":"#/components/schemas/DateRange"},"definition":{"$ref":"#/components/schemas/GenericObjectDefinition"},"definitionId":{"type":"string"},"description":{"type":"string","description":"The description of the widget's usage and data representation."},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"indexName":{"type":"string"},"isPredefined":{"type":"boolean","description":"Is the widget a system widget."},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean","description":"Is the widget locked for editing."},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Default name of the widget."},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"params":{"type":"object","description":"Additional parameters for this widget, depends on widget type and data.","additionalProperties":{"type":"object"}},"prevName":{"type":"string","description":"The previous name of the widget."},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"query":{"type":"string","description":"Query to search on the dataType."},"remote":{"type":"boolean"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"skipAggregateAccounts":{"type":"boolean","description":"SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"widgetType":{"type":"string","description":"Widget type describes how does the widget should recieve the data, and display it. Supporting types: \"bar\", \"column\", \"pie\", \"list\", \"number\", \"trend\", \"text\", \"duration\", \"image\", \"line\", and \"table\"."}},"required":["name","widgetType"]},"DateRange":{"type":"object","description":"DateRange provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"GenericObjectDefinition":{"type":"object","title":"GenericObjectDefinition ...","properties":{"auditable":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"definitionId":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"partitioned":{"type":"boolean"},"pluralName":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"rbacSupport":{"type":"boolean"},"remote":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The DateRange object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"DateRange":{"type":"object","description":"DateRange provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}}}}}
```

## The Period object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}}}}}
```

## The GenericObjectDefinition object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"GenericObjectDefinition":{"type":"object","title":"GenericObjectDefinition ...","properties":{"auditable":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"definitionId":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"partitioned":{"type":"boolean"},"pluralName":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"rbacSupport":{"type":"boolean"},"remote":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}}}}}
```

## The updateEntry object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"},"markdown":{"type":"boolean"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"version":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The Entry object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Entry":{"type":"object","description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"reputations":{"type":"array","description":"EntryReputations the reputations calculated by regex match","items":{"$ref":"#/components/schemas/EntryReputation"}},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"IndicatorTimeline":{"type":"array","title":"IndicatorTimeline ...","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Reliability":{"type":"string","title":"Reliability ..."},"APIExecutionMetric":{"type":"object","description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}}},"EntryCategory":{"type":"string","title":"EntryCategory ..."},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","description":"EntryTask holds information regarding the related task","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}}},"FileMetadata":{"type":"object","title":"FileMetadata ...","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"type":"object","title":"EntryHistory ...","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"EntryReputation":{"type":"object","description":"EntryReputation holds the entry reputations and the highlights","properties":{"highlights":{"$ref":"#/components/schemas/FieldTermLocationMap"},"reputationsData":{"type":"array","items":{"$ref":"#/components/schemas/ReputationData"}}}},"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}},"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}}
```

## The IndicatorTimeline object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IndicatorTimeline":{"type":"array","title":"IndicatorTimeline ...","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}}}}}
```

## The IndicatorTimelineFromEntry object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IndicatorTimelineFromEntry":{"type":"object","title":"IndicatorTimelineFromEntry ...","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}}}}}
```

## The APIExecutionMetric object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"APIExecutionMetric":{"type":"object","description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}}}}}}
```

## The EntryCategory object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EntryCategory":{"type":"string","title":"EntryCategory ..."}}}}
```

## The EndingType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"}}}}
```

## The EntryTask object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EntryTask":{"type":"object","description":"EntryTask holds information regarding the related task","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}}}}}}
```

## The FileMetadata object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FileMetadata":{"type":"object","title":"FileMetadata ...","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}}}}}
```

## The EntryHistory object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EntryHistory":{"type":"object","title":"EntryHistory ...","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}}}}}
```

## The HumanCron object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}}}}}
```

## The ModuleArgs object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}}}}}
```

## The EntryReputation object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EntryReputation":{"type":"object","description":"EntryReputation holds the entry reputations and the highlights","properties":{"highlights":{"$ref":"#/components/schemas/FieldTermLocationMap"},"reputationsData":{"type":"array","items":{"$ref":"#/components/schemas/ReputationData"}}}},"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}},"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}}}}}
```

## The FieldTermLocationMap object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FieldTermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/TermLocationMap"}},"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}}}}}
```

## The TermLocationMap object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TermLocationMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/Locations"}},"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}}}}}
```

## The Locations object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Locations":{"type":"array","items":{"$ref":"#/components/schemas/Location"}},"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}}}}}
```

## The Location object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Location":{"type":"object","properties":{"array_positions":{"$ref":"#/components/schemas/ArrayPositions"},"end":{"type":"integer","format":"uint64"},"pos":{"type":"integer","description":"Pos is the position of the term within the field, starting at 1","format":"uint64"},"start":{"type":"integer","description":"Start and End are the byte offsets of the term in the field","format":"uint64"}}},"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}}}}}
```

## The ArrayPositions object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}}}}}
```

## The ReputationData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ReputationData":{"type":"object","description":"ReputationData holds the reputation data (reputation, regex, highlights result)","properties":{"rawTerm":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputationId":{"type":"string"},"term":{"type":"string"}}}}}}
```

## The EntryType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}}
```

## The DownloadEntry object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"DownloadEntry":{"type":"object","title":"DownloadEntry ...","properties":{"id":{"type":"string"},"investigationId":{"type":"string"}}}}}}
```

## The uploadedEntry object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"uploadedEntry":{"type":"object","properties":{"contents":{"type":"string"},"format":{"type":"string"},"investigationId":{"type":"string"}}}}}}
```

## The updateEntryTags object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"updateEntryTags":{"type":"object","properties":{"id":{"type":"string"},"investigationId":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"tags":{"type":"array","items":{"type":"string"}},"version":{"type":"integer","format":"int64"}}}}}}
```

## The Evidence object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Evidence":{"type":"object","title":"Evidence details.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"description":{"type":"string","description":"The description for the resolve"},"entryId":{"type":"string","description":"The entry ID"},"fetched":{"type":"string","description":"when the evidence entry was fetched","format":"date-time"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentId":{"type":"string","description":"The incident ID"},"indexName":{"type":"string"},"markedBy":{"type":"string","description":"the user that marked this evidence"},"markedDate":{"type":"string","description":"when this evidence was marked","format":"date-time"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this evidence has occurred","format":"date-time"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"when the evidence entry was fetched"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}}}}}
```

## The deleteEvidence object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"deleteEvidence":{"type":"object","properties":{"evidenceID":{"type":"string"}}}}}}
```

## The evidencesFilterWrapper object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"evidencesFilterWrapper":{"type":"object","properties":{"filter":{"$ref":"#/components/schemas/GenericStringDateFilter"},"incidentID":{"type":"string"}}},"GenericStringDateFilter":{"type":"object","description":"GenericStringDateFilter is a general filter that will fetch entities using the Query value and a date filter","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The GenericStringDateFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"GenericStringDateFilter":{"type":"object","description":"GenericStringDateFilter is a general filter that will fetch entities using the Query value and a date filter","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The EvidencesSearchResponse object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EvidencesSearchResponse":{"type":"object","description":"EvidencesSearchResponse returns the response from the evidences search","properties":{"evidences":{"$ref":"#/components/schemas/Evidences"},"total":{"type":"integer","format":"int64"}}},"Evidences":{"type":"array","description":"Evidences is a list of evidence entities","items":{"$ref":"#/components/schemas/Evidence"}},"Evidence":{"type":"object","title":"Evidence details.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"description":{"type":"string","description":"The description for the resolve"},"entryId":{"type":"string","description":"The entry ID"},"fetched":{"type":"string","description":"when the evidence entry was fetched","format":"date-time"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentId":{"type":"string","description":"The incident ID"},"indexName":{"type":"string"},"markedBy":{"type":"string","description":"the user that marked this evidence"},"markedDate":{"type":"string","description":"when this evidence was marked","format":"date-time"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this evidence has occurred","format":"date-time"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"when the evidence entry was fetched"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}}}}}
```

## The Evidences object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Evidences":{"type":"array","description":"Evidences is a list of evidence entities","items":{"$ref":"#/components/schemas/Evidence"}},"Evidence":{"type":"object","title":"Evidence details.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"description":{"type":"string","description":"The description for the resolve"},"entryId":{"type":"string","description":"The entry ID"},"fetched":{"type":"string","description":"when the evidence entry was fetched","format":"date-time"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentId":{"type":"string","description":"The incident ID"},"indexName":{"type":"string"},"markedBy":{"type":"string","description":"the user that marked this evidence"},"markedDate":{"type":"string","description":"when this evidence was marked","format":"date-time"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this evidence has occurred","format":"date-time"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"when the evidence entry was fetched"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}}}}}
```

## The containersInfo object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"containersInfo":{"type":"object","description":"Info - holds all containers info","properties":{"all":{"type":"integer","format":"int64"},"inactive":{"type":"integer","format":"int64"},"running":{"type":"integer","format":"int64"}}}}}}
```

## The CreateIncidentRequest object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"CreateIncidentRequest":{"type":"object","description":"CreateIncidentRequest is an extension for Incident entity, with additional field of changed-status for the web client.","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"createInvestigation":{"type":"boolean"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"indexName":{"type":"string"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason an incident was closed."},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Label":{"type":"object","title":"Label ...","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"type":"string","description":"RunStatus of a job"},"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4},"SLAState":{"type":"number","description":"SLAState is the incident sla at closure time, in minutes.","format":"double"},"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2}}}}
```

## The Label object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Label":{"type":"object","title":"Label ...","properties":{"type":{"type":"string"},"value":{"type":"string"}}}}}}
```

## The RunStatus object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"RunStatus":{"type":"string","description":"RunStatus of a job"}}}}
```

## The Severity object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4}}}}
```

## The SLAState object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"SLAState":{"type":"number","description":"SLAState is the incident sla at closure time, in minutes.","format":"double"}}}}
```

## The IncidentStatus object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2}}}}
```

## The IncidentWrapper object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IncidentWrapper":{"type":"object","description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Attachment":{"type":"object","title":"Attachment ...","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}}},"Label":{"type":"object","title":"Label ...","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"type":"string","description":"RunStatus of a job"},"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4},"SLAState":{"type":"number","description":"SLAState is the incident sla at closure time, in minutes.","format":"double"},"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2}}}}
```

## The Attachment object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Attachment":{"type":"object","title":"Attachment ...","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}}}}}}
```

## The UpdateDataBatch object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"UpdateDataBatch":{"type":"object","title":"UpdateDataBatch ...","properties":{"CustomFields":{"type":"object","additionalProperties":{"type":"object"}},"all":{"type":"boolean"},"closeNotes":{"type":"string"},"closeReason":{"type":"string"},"columns":{"type":"array","items":{"type":"string"}},"data":{"type":"object","additionalProperties":{"type":"object"}},"filter":{"$ref":"#/components/schemas/IncidentFilter"},"force":{"type":"boolean"},"ids":{"type":"array","items":{"type":"string"}},"line":{"type":"string"},"originalIncidentId":{"type":"string"},"overrideInvestigation":{"type":"boolean"}}},"IncidentFilter":{"type":"object","title":"IncidentFilter allows for very simple filtering.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"fields":{"type":"array","items":{"type":"string"}},"files":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromActivatedDate":{"type":"string","format":"date-time"},"fromClosedDate":{"type":"string","format":"date-time"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"fromDueDate":{"type":"string","format":"date-time"},"fromReminder":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"includeTmp":{"type":"boolean"},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notCategory":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"notStatus":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"parent":{"type":"array","items":{"type":"string"}},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"systems":{"type":"array","items":{"type":"string"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toActivatedDate":{"type":"string","format":"date-time"},"toClosedDate":{"type":"string","format":"date-time"},"toDate":{"type":"string","format":"date-time"},"toDueDate":{"type":"string","format":"date-time"},"toReminder":{"type":"string","format":"date-time"},"totalOnly":{"type":"boolean"},"trim_events":{"type":"integer","format":"int64"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}},"users":{"type":"array","items":{"type":"string"}}}},"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4},"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The IncidentFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IncidentFilter":{"type":"object","title":"IncidentFilter allows for very simple filtering.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"fields":{"type":"array","items":{"type":"string"}},"files":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromActivatedDate":{"type":"string","format":"date-time"},"fromClosedDate":{"type":"string","format":"date-time"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"fromDueDate":{"type":"string","format":"date-time"},"fromReminder":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"includeTmp":{"type":"boolean"},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notCategory":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"notStatus":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"parent":{"type":"array","items":{"type":"string"}},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"systems":{"type":"array","items":{"type":"string"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toActivatedDate":{"type":"string","format":"date-time"},"toClosedDate":{"type":"string","format":"date-time"},"toDate":{"type":"string","format":"date-time"},"toDueDate":{"type":"string","format":"date-time"},"toReminder":{"type":"string","format":"date-time"},"totalOnly":{"type":"boolean"},"trim_events":{"type":"integer","format":"int64"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}},"users":{"type":"array","items":{"type":"string"}}}},"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4},"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The IncidentSearchResponseWrapper object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IncidentSearchResponseWrapper":{"type":"object","description":"IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"data":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/IncidentWrapper"}},"notUpdated":{"type":"integer","format":"uint64"},"searchAfter":{"type":"array","items":{"type":"string"}},"searchAfterElastic":{"type":"array","items":{"type":"string"}},"searchBefore":{"type":"array","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","items":{"type":"string"}},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IncidentWrapper":{"type":"object","description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Attachment":{"type":"object","title":"Attachment ...","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}}},"Label":{"type":"object","title":"Label ...","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"type":"string","description":"RunStatus of a job"},"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4},"SLAState":{"type":"number","description":"SLAState is the incident sla at closure time, in minutes.","format":"double"},"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2}}}}
```

## The tagsFieldValues object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"tagsFieldValues":{"type":"object","properties":{"data":{"type":"array","items":{"type":"string"}}}}}}}
```

## The IncidentField object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IncidentField":{"type":"object","title":"IncidentField ...","properties":{"aliasTo":{"type":"string"},"aliases":{"type":"array","items":{"$ref":"#/components/schemas/FieldsAlias"}},"associatedToAll":{"type":"boolean"},"associatedTypes":{"type":"array","description":"AssociatedTypes - list of incident (case) types IDs related to specific incident field","items":{"type":"string"}},"autoCompleteTags":{"type":"array","items":{"type":"string"}},"breachScript":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"caseInsensitive":{"type":"boolean"},"cliName":{"type":"string"},"closeForm":{"type":"boolean"},"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"commitMessage":{"type":"string"},"content":{"type":"boolean"},"created":{"type":"string","format":"date-time"},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"definitionId":{"type":"string"},"description":{"type":"string"},"editForm":{"type":"boolean"},"fieldCalcScript":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"group":{"$ref":"#/components/schemas/FieldGroup"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isReadOnly":{"type":"boolean"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"mergeStrategy":{"$ref":"#/components/schemas/FieldMergeStrategy"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"neverSetAsRequired":{"type":"boolean"},"numericId":{"type":"integer","format":"int64"},"openEnded":{"type":"boolean"},"orgType":{"type":"string"},"ownerOnly":{"type":"boolean"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"placeholder":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"required":{"type":"boolean"},"runScriptAfterUpdate":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"systemAssociatedTypes":{"type":"array","items":{"type":"string"}},"template":{"type":"string"},"threshold":{"type":"number","format":"double"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"type":"string"},"unmapped":{"type":"boolean"},"unsearchable":{"type":"boolean"},"useAsKpi":{"type":"boolean"},"validatedError":{"type":"string"},"validationRegex":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"x2_fields":{"type":"string"}}},"FieldsAlias":{"type":"object","title":"FieldsAlias ...","properties":{"cliName":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"FieldGroup":{"type":"number","description":"FieldGroup is the field group","format":"double"},"FieldMergeStrategy":{"type":"string","description":"FieldMergeStrategy strategy for merging of indicator fields"}}}}
```

## The FieldsAlias object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FieldsAlias":{"type":"object","title":"FieldsAlias ...","properties":{"cliName":{"type":"string"},"type":{"type":"string"}}}}}}
```

## The GridColumn object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}}}}}
```

## The FieldGroup object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FieldGroup":{"type":"number","description":"FieldGroup is the field group","format":"double"}}}}
```

## The FieldMergeStrategy object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FieldMergeStrategy":{"type":"string","description":"FieldMergeStrategy strategy for merging of indicator fields"}}}}
```

## The incidentFieldsWithErrors object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"incidentFieldsWithErrors":{"type":"object","properties":{"error":{"type":"string"},"incidentFields":{"type":"array","items":{"$ref":"#/components/schemas/IncidentField"}}}},"IncidentField":{"type":"object","title":"IncidentField ...","properties":{"aliasTo":{"type":"string"},"aliases":{"type":"array","items":{"$ref":"#/components/schemas/FieldsAlias"}},"associatedToAll":{"type":"boolean"},"associatedTypes":{"type":"array","description":"AssociatedTypes - list of incident (case) types IDs related to specific incident field","items":{"type":"string"}},"autoCompleteTags":{"type":"array","items":{"type":"string"}},"breachScript":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"caseInsensitive":{"type":"boolean"},"cliName":{"type":"string"},"closeForm":{"type":"boolean"},"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"commitMessage":{"type":"string"},"content":{"type":"boolean"},"created":{"type":"string","format":"date-time"},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"definitionId":{"type":"string"},"description":{"type":"string"},"editForm":{"type":"boolean"},"fieldCalcScript":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"group":{"$ref":"#/components/schemas/FieldGroup"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isReadOnly":{"type":"boolean"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"mergeStrategy":{"$ref":"#/components/schemas/FieldMergeStrategy"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"neverSetAsRequired":{"type":"boolean"},"numericId":{"type":"integer","format":"int64"},"openEnded":{"type":"boolean"},"orgType":{"type":"string"},"ownerOnly":{"type":"boolean"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"placeholder":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"required":{"type":"boolean"},"runScriptAfterUpdate":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"systemAssociatedTypes":{"type":"array","items":{"type":"string"}},"template":{"type":"string"},"threshold":{"type":"number","format":"double"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"type":"string"},"unmapped":{"type":"boolean"},"unsearchable":{"type":"boolean"},"useAsKpi":{"type":"boolean"},"validatedError":{"type":"string"},"validationRegex":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"x2_fields":{"type":"string"}}},"FieldsAlias":{"type":"object","title":"FieldsAlias ...","properties":{"cliName":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"FieldGroup":{"type":"number","description":"FieldGroup is the field group","format":"double"},"FieldMergeStrategy":{"type":"string","description":"FieldMergeStrategy strategy for merging of indicator fields"}}}}
```

## The SearchIncidentsData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"SearchIncidentsData":{"type":"object","title":"SearchIncidentsData ...","properties":{"filter":{"$ref":"#/components/schemas/IncidentFilter"},"userFilter":{"type":"boolean"}}},"IncidentFilter":{"type":"object","title":"IncidentFilter allows for very simple filtering.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"fields":{"type":"array","items":{"type":"string"}},"files":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromActivatedDate":{"type":"string","format":"date-time"},"fromClosedDate":{"type":"string","format":"date-time"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"fromDueDate":{"type":"string","format":"date-time"},"fromReminder":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"includeTmp":{"type":"boolean"},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notCategory":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"notStatus":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"parent":{"type":"array","items":{"type":"string"}},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"systems":{"type":"array","items":{"type":"string"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toActivatedDate":{"type":"string","format":"date-time"},"toClosedDate":{"type":"string","format":"date-time"},"toDate":{"type":"string","format":"date-time"},"toDueDate":{"type":"string","format":"date-time"},"toReminder":{"type":"string","format":"date-time"},"totalOnly":{"type":"boolean"},"trim_events":{"type":"integer","format":"int64"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}},"users":{"type":"array","items":{"type":"string"}}}},"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4},"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The Incident object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Incident":{"type":"object","title":"Incident details.","description":"An incident can be manually opened algorithmically or arrive from an external source like SIEM.\nNote: CustomFields (an optional generic object type) is missing from swagger properties definition.","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Attachment":{"type":"object","title":"Attachment ...","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}}},"Label":{"type":"object","title":"Label ...","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"type":"string","description":"RunStatus of a job"},"Severity":{"type":"number","description":"Severity is the incident severity","format":"double","minimum":0,"multipleOf":4},"SLAState":{"type":"number","description":"SLAState is the incident sla at closure time, in minutes.","format":"double"},"IncidentStatus":{"type":"number","description":"IncidentStatus is the status of the incident","format":"double","minimum":0,"maximum":2}}}}
```

## The IncidentType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IncidentType":{"type":"object","title":"IncidentType ...","properties":{"autorun":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"closureScript":{"type":"string"},"color":{"type":"string"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"days":{"type":"integer","format":"int64"},"daysR":{"type":"integer","format":"int64"},"default":{"type":"boolean"},"definitionId":{"type":"string"},"detached":{"type":"boolean"},"disabled":{"type":"boolean"},"extractSettings":{"$ref":"#/components/schemas/IncidentTypeExtractSettings"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"hours":{"type":"integer","format":"int64"},"hoursR":{"type":"integer","format":"int64"},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"layout":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"onChangeRepAlg":{"$ref":"#/components/schemas/ReputationCalcAlg"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"playbookId":{"type":"string"},"preProcessingScript":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"readonly":{"type":"boolean"},"remote":{"type":"boolean"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"type":"integer","format":"int64"},"slaReminder":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"},"weeksR":{"type":"integer","format":"int64"}}},"IncidentTypeExtractSettings":{"type":"object","title":"IncidentTypeExtractSettings ...","properties":{"fieldCliNameToExtractSettings":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FieldExtractSetting"}},"mode":{"$ref":"#/components/schemas/ExtractSettingsMode"}}},"FieldExtractSetting":{"type":"object","title":"FieldExtractSetting ...","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}},"ExtractSettingsMode":{"type":"string","title":"ExtractSettingsMode ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"}}}}
```

## The IncidentTypeExtractSettings object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IncidentTypeExtractSettings":{"type":"object","title":"IncidentTypeExtractSettings ...","properties":{"fieldCliNameToExtractSettings":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FieldExtractSetting"}},"mode":{"$ref":"#/components/schemas/ExtractSettingsMode"}}},"FieldExtractSetting":{"type":"object","title":"FieldExtractSetting ...","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}},"ExtractSettingsMode":{"type":"string","title":"ExtractSettingsMode ..."}}}}
```

## The FieldExtractSetting object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FieldExtractSetting":{"type":"object","title":"FieldExtractSetting ...","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}}}}}
```

## The ExtractSettingsMode object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ExtractSettingsMode":{"type":"string","title":"ExtractSettingsMode ..."}}}}
```

## The ReputationCalcAlg object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"}}}}
```

## The incidentTypesWithErrors object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"incidentTypesWithErrors":{"type":"object","properties":{"error":{"type":"string"},"incidentTypes":{"type":"array","items":{"$ref":"#/components/schemas/IncidentType"}}}},"IncidentType":{"type":"object","title":"IncidentType ...","properties":{"autorun":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"closureScript":{"type":"string"},"color":{"type":"string"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"days":{"type":"integer","format":"int64"},"daysR":{"type":"integer","format":"int64"},"default":{"type":"boolean"},"definitionId":{"type":"string"},"detached":{"type":"boolean"},"disabled":{"type":"boolean"},"extractSettings":{"$ref":"#/components/schemas/IncidentTypeExtractSettings"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"hours":{"type":"integer","format":"int64"},"hoursR":{"type":"integer","format":"int64"},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"layout":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"onChangeRepAlg":{"$ref":"#/components/schemas/ReputationCalcAlg"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"playbookId":{"type":"string"},"preProcessingScript":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"readonly":{"type":"boolean"},"remote":{"type":"boolean"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"type":"integer","format":"int64"},"slaReminder":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"},"weeksR":{"type":"integer","format":"int64"}}},"IncidentTypeExtractSettings":{"type":"object","title":"IncidentTypeExtractSettings ...","properties":{"fieldCliNameToExtractSettings":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FieldExtractSetting"}},"mode":{"$ref":"#/components/schemas/ExtractSettingsMode"}}},"FieldExtractSetting":{"type":"object","title":"FieldExtractSetting ...","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}},"ExtractSettingsMode":{"type":"string","title":"ExtractSettingsMode ..."},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"}}}}
```

## The indicatorContext object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"indicatorContext":{"type":"object","properties":{"entryId":{"type":"string"},"indicator":{"$ref":"#/components/schemas/IocObject"},"investigationId":{"type":"string"},"manually":{"type":"boolean"},"seenNow":{"type":"boolean"}}},"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The IocObject object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The Comments object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."}}}}
```

## The Comment object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."}}}}
```

## The CommentType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."}}}}
```

## The ExpirationStatus object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."}}}}
```

## The InsightCache object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}}}}}
```

## The DBotScore object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}}}}}
```

## The updateIndicatorReputationData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"updateIndicatorReputationData":{"type":"object","properties":{"InvestigationId":{"type":"string"},"doNotWhitelist":{"type":"boolean"},"entryId":{"type":"string"},"manualScore":{"type":"boolean"},"reason":{"type":"string"},"reputation":{"type":"integer","format":"int64"},"reputations":{"type":"array","items":{"type":"string"}},"value":{"type":"string"}}}}}}
```

## The UpdateResponse object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"UpdateResponse":{"type":"object","title":"UpdateResponse ...","properties":{"notUpdated":{"type":"integer","format":"int64"},"updatedIds":{"type":"array","items":{"type":"string"}},"uppdated":{"type":"integer","format":"int64"}}}}}}
```

## The genericIndicatorUpdateBatch object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"genericIndicatorUpdateBatch":{"type":"object","properties":{"all":{"type":"boolean"},"columns":{"type":"array","items":{"type":"string"}},"doNotWhitelist":{"type":"boolean"},"filter":{"$ref":"#/components/schemas/IndicatorFilter"},"ids":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}}}},"IndicatorFilter":{"type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"earlyTimeInPage":{"type":"string","format":"date-time"},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"laterTimeInPage":{"type":"string","format":"date-time"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"prevPage":{"type":"boolean","description":"MT support - these fields are for indicator search according to calculatedTime"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The IndicatorFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IndicatorFilter":{"type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"earlyTimeInPage":{"type":"string","format":"date-time"},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"laterTimeInPage":{"type":"string","format":"date-time"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"prevPage":{"type":"boolean","description":"MT support - these fields are for indicator search according to calculatedTime"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}}}}}
```

## The DateRangeFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"DateRangeFilter":{"type":"object","description":"DateRangeFilter provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The FeedIndicatorsRequest object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FeedIndicatorsRequest":{"type":"object","description":"FeedIndicatorsRequest is the input for JSON feed indicator ingestion","properties":{"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"indicators":{"type":"array","items":{"$ref":"#/components/schemas/RawFeedIndicator"}},"mapperId":{"type":"string"}}},"RawFeedIndicator":{"type":"object","description":"RawFeedIndicator is an unparsed feed indicator from JSON ingestion","additionalProperties":{"type":"object"}}}}}
```

## The RawFeedIndicator object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"RawFeedIndicator":{"type":"object","description":"RawFeedIndicator is an unparsed feed indicator from JSON ingestion","additionalProperties":{"type":"object"}}}}}
```

## The IndicatorResult object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IndicatorResult":{"type":"object","title":"IndicatorResult ...","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"iocObjects":{"$ref":"#/components/schemas/IocObjects"},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IocObjects":{"type":"array","title":"IocObjects ...","items":{"$ref":"#/components/schemas/IocObject"}},"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The IocObjects object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IocObjects":{"type":"array","title":"IocObjects ...","items":{"$ref":"#/components/schemas/IocObject"}},"IocObject":{"type":"object","description":"IocObject - represents an Ioc (or simply an indicator) object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"created":{"type":"string","format":"date-time"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CustomFields":{"type":"object","title":"CustomFields ...","description":"The keys should be the field's display name all lower and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update","additionalProperties":{"type":"object"}},"Comments":{"type":"array","title":"Comments ...","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"type":"object","title":"Comment ...","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"type":"string","title":"CommentType - comment type: regular comment, time-line, etc..."},"ExpirationSource":{"type":"object","title":"ExpirationSource ..\t.","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"type":"string","title":"ExpirationPolicy ..."},"ExpirationSettingsSource":{"type":"string","title":"ExpirationSettingsSource ..."},"ExpirationStatus":{"type":"string","title":"ExpirationStatus ..."},"InsightCache":{"type":"object","description":"InsightCache - map insight name to all its metadata, name will be case insensitive","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"DBotScore":{"type":"object","description":"DBotScore - Contain the score of a specific brand for a specific insight","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object"}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"FeedIndicator":{"type":"object","title":"FeedIndicator ...","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object"}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}}},"FeedIndicatorComment":{"type":"object","title":"FeedIndicatorComment ...","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"type":"array","title":"RelationshipsAPI ...","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"type":"object","title":"RelationshipAPI ...","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}}},"Reliability":{"type":"string","title":"Reliability ..."}}}}
```

## The IndicatorEditBulkResponse object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IndicatorEditBulkResponse":{"type":"object","title":"IndicatorEditBulkResponse ...","properties":{"total":{"type":"integer","format":"uint64"},"updated":{"type":"integer","format":"uint64"}}}}}}
```

## The WhitelistedIndicator object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"WhitelistedIndicator":{"type":"object","description":"WhitelistedIndicator Excluded indicator","properties":{"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"type":{"type":"string"},"user":{"type":"string"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"},"whitelistTime":{"type":"string","format":"date-time"}}}}}}
```

## The InvPlaybookTaskData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvPlaybookTaskData":{"type":"object","title":"InvPlaybookTaskData ...","properties":{"addAfter":{"type":"boolean"},"addToSeparateBranch":{"type":"boolean"},"automationScript":{"type":"string"},"description":{"type":"string"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"name":{"type":"string"},"neighborInvPBTaskId":{"type":"string"},"playbookId":{"type":"string"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"}}},"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"}}}}
```

## The TaskLoop object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."}}}}
```

## The TaskType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"}}}}
```

## The InvestigationPlaybook object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationPlaybook":{"type":"object","description":"InvestigationPlaybook is a wrapper for a linked list of Playbook tasks","properties":{"Dirty":{"type":"boolean"},"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object"}}},"ReplacedPlaybook":{"type":"boolean","description":"Indicate whether this playbook has new history during this session"},"ShardID":{"type":"integer","format":"int64"},"UpdatedOperatorIDs":{"type":"boolean"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"autoExtracting":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentCreateDate":{"type":"string","description":"Incident create date","format":"date-time"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"invPBDebugInfo":{"$ref":"#/components/schemas/InvPlaybookDebugInfo"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pbHistory":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/InvestigationPlaybookData"}},"pendingTasks":{"type":"object","description":"Tasks that are marked for running, but cannot yet run due to incomplete parents","additionalProperties":{"type":"object"}},"playbookId":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"quiet":{"type":"boolean"},"recoveryAttempts":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"serverId":{"type":"string","description":"Holds the ID of the responsible cluster app server"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"syncHash":{"type":"string"},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","description":"PlaybookInput represents the playbook input","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"InvPlaybookDebugInfo":{"type":"object","title":"InvPlaybookDebugInfo ...","properties":{"originalInvPBId":{"type":"string"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","description":"PlaybookOutput represents the playbook output","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"InvestigationPlaybookData":{"type":"object","description":"InvestigationPlaybookData returns all data of an investigation playbook, not including history","properties":{"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object"}}},"autoExtracting":{"type":"boolean"},"comment":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"name":{"type":"string"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pendingTasks":{"type":"object","description":"Tasks that are marked for running, but cannot yet run due to incomplete parents","additionalProperties":{"type":"object"}},"playbookId":{"type":"string"},"quiet":{"type":"boolean"},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"view":{"$ref":"#/components/schemas/PlaybookView"}}},"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"},"InvestigationPlaybookTask":{"type":"object","description":"InvestigationPlaybookTask is the Task in the playbook context as a node","properties":{"Reopen":{"type":"boolean"},"arguments":{"type":"object","additionalProperties":{"type":"object"}},"assignee":{"type":"string"},"assigneeSet":{"type":"boolean"},"blockingTasks":{"type":"array","items":{"type":"string"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"comments":{"type":"boolean","description":"Whether this task had any comments or not"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"doNotSaveTaskHistory":{"type":"boolean"},"dueDate":{"type":"string","format":"date-time"},"dueDateDuration":{"type":"integer","format":"int64"},"dueDateDurationUnit":{"$ref":"#/components/schemas/SLADurationUnit"},"dueDateSet":{"type":"boolean"},"entries":{"type":"array","items":{"type":"string"}},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"executionCount":{"type":"integer","format":"int64"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"forEachIndex":{"type":"integer","description":"Parameters needed for loops","format":"int64"},"forEachInputs":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"hasErrorEntries":{"type":"boolean"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"indent":{"type":"integer","format":"int64"},"input":{"type":"string"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"missingContentItem":{"type":"string","description":"content item which caused task to skip"},"nextPollingTime":{"type":"string","description":"NextPollTime Time of the next scheduled command execution","format":"date-time"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"outputs":{"type":"object","additionalProperties":{"type":"object"}},"parentBlockCount":{"type":"integer","description":"the number of tasks that are waiting on blocked in subplaybooks of this task","format":"int64"},"parentPlaybookID":{"type":"string"},"patched":{"type":"boolean","description":"Indicates whether this task was patched to InvPB and did not originally belong to the playbook"},"playbookInputs":{"type":"object","additionalProperties":{"type":"object"}},"pollingEntries":{"type":"array","description":"PollingEntryIDs IDs of entries that are still polling","items":{"type":"string"}},"pollingTimeoutTime":{"type":"string","format":"date-time"},"previousTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reminder":{"type":"integer","description":"Duration in minutes, this field is not persisted here","format":"int64"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skip":{"type":"boolean","description":"Skip - if true then this task will be skipped and all the tasks which comes after this task and depend on it\nwill skip (WillNotExecute)"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"startDate":{"type":"string","format":"date-time"},"startedExecutingHarmfulScript":{"type":"boolean"},"state":{"$ref":"#/components/schemas/TaskState"},"subPlaybook":{"$ref":"#/components/schemas/InvestigationPlaybook"},"task":{"$ref":"#/components/schemas/Task"},"taskCompleteData":{"type":"array","description":"History complete data","items":{"$ref":"#/components/schemas/InvPlaybookTaskCompleteData"}},"taskDebug":{"$ref":"#/components/schemas/InvTaskDebug"},"taskId":{"type":"string"},"taskSize":{"type":"integer","format":"int64"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"timesPolled":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}},"ContinueOnErrorType":{"type":"string","title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path."},"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"},"EvidenceData":{"type":"object","description":"EvidenceData - all evidence properties to evaluate in task process","properties":{"customFields":{"type":"object","description":"This field must have empty json key","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}}},"FieldMapping":{"type":"object","description":"FieldMapping - Map a task output (complex or simple value) to an incident field","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}}},"DataCollectionForm":{"type":"object","title":"DataCollectionForm - a data collection form with questions.","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"type":"object","title":"FormDisplay - display options for communication/ask task (for both email and web forms).","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"NotifiableItem":{"type":"object","title":"NotifiableItem ...","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"},"SLA":{"type":"object","title":"SLA ...","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"},"Task":{"type":"object","description":"Task is the basic task in the task repository that can be associated to an incident via playbook","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}}},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"InvPlaybookTaskCompleteData":{"type":"object","title":"InvPlaybookTaskCompleteData ...","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object"}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object"}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"InvTaskDebug":{"type":"object","title":"InvTaskDebug ...","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object"}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"TimerTrigger":{"type":"object","title":"TimerTrigger ...","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"type":"string","title":"TimerAction ..."},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}}
```

## The PlaybookInputs object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","description":"PlaybookInput represents the playbook input","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The PlaybookInput object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"PlaybookInput":{"type":"object","description":"PlaybookInput represents the playbook input","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The PlaybookInputQuery object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}}}}}
```

## The QueryState object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}}}}}
```

## The InvPlaybookDebugInfo object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvPlaybookDebugInfo":{"type":"object","title":"InvPlaybookDebugInfo ...","properties":{"originalInvPBId":{"type":"string"}}}}}}
```

## The PlaybookOutputs object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","description":"PlaybookOutput represents the playbook output","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."}}}}
```

## The PlaybookOutput object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"PlaybookOutput":{"type":"object","description":"PlaybookOutput represents the playbook output","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."}}}}
```

## The InvestigationPlaybookData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationPlaybookData":{"type":"object","description":"InvestigationPlaybookData returns all data of an investigation playbook, not including history","properties":{"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object"}}},"autoExtracting":{"type":"boolean"},"comment":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"name":{"type":"string"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pendingTasks":{"type":"object","description":"Tasks that are marked for running, but cannot yet run due to incomplete parents","additionalProperties":{"type":"object"}},"playbookId":{"type":"string"},"quiet":{"type":"boolean"},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"view":{"$ref":"#/components/schemas/PlaybookView"}}},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","description":"PlaybookInput represents the playbook input","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","description":"PlaybookOutput represents the playbook output","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"},"InvestigationPlaybookTask":{"type":"object","description":"InvestigationPlaybookTask is the Task in the playbook context as a node","properties":{"Reopen":{"type":"boolean"},"arguments":{"type":"object","additionalProperties":{"type":"object"}},"assignee":{"type":"string"},"assigneeSet":{"type":"boolean"},"blockingTasks":{"type":"array","items":{"type":"string"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"comments":{"type":"boolean","description":"Whether this task had any comments or not"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"doNotSaveTaskHistory":{"type":"boolean"},"dueDate":{"type":"string","format":"date-time"},"dueDateDuration":{"type":"integer","format":"int64"},"dueDateDurationUnit":{"$ref":"#/components/schemas/SLADurationUnit"},"dueDateSet":{"type":"boolean"},"entries":{"type":"array","items":{"type":"string"}},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"executionCount":{"type":"integer","format":"int64"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"forEachIndex":{"type":"integer","description":"Parameters needed for loops","format":"int64"},"forEachInputs":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"hasErrorEntries":{"type":"boolean"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"indent":{"type":"integer","format":"int64"},"input":{"type":"string"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"missingContentItem":{"type":"string","description":"content item which caused task to skip"},"nextPollingTime":{"type":"string","description":"NextPollTime Time of the next scheduled command execution","format":"date-time"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"outputs":{"type":"object","additionalProperties":{"type":"object"}},"parentBlockCount":{"type":"integer","description":"the number of tasks that are waiting on blocked in subplaybooks of this task","format":"int64"},"parentPlaybookID":{"type":"string"},"patched":{"type":"boolean","description":"Indicates whether this task was patched to InvPB and did not originally belong to the playbook"},"playbookInputs":{"type":"object","additionalProperties":{"type":"object"}},"pollingEntries":{"type":"array","description":"PollingEntryIDs IDs of entries that are still polling","items":{"type":"string"}},"pollingTimeoutTime":{"type":"string","format":"date-time"},"previousTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reminder":{"type":"integer","description":"Duration in minutes, this field is not persisted here","format":"int64"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skip":{"type":"boolean","description":"Skip - if true then this task will be skipped and all the tasks which comes after this task and depend on it\nwill skip (WillNotExecute)"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"startDate":{"type":"string","format":"date-time"},"startedExecutingHarmfulScript":{"type":"boolean"},"state":{"$ref":"#/components/schemas/TaskState"},"subPlaybook":{"$ref":"#/components/schemas/InvestigationPlaybook"},"task":{"$ref":"#/components/schemas/Task"},"taskCompleteData":{"type":"array","description":"History complete data","items":{"$ref":"#/components/schemas/InvPlaybookTaskCompleteData"}},"taskDebug":{"$ref":"#/components/schemas/InvTaskDebug"},"taskId":{"type":"string"},"taskSize":{"type":"integer","format":"int64"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"timesPolled":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}},"ContinueOnErrorType":{"type":"string","title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path."},"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"},"EvidenceData":{"type":"object","description":"EvidenceData - all evidence properties to evaluate in task process","properties":{"customFields":{"type":"object","description":"This field must have empty json key","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}}},"FieldMapping":{"type":"object","description":"FieldMapping - Map a task output (complex or simple value) to an incident field","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}}},"DataCollectionForm":{"type":"object","title":"DataCollectionForm - a data collection form with questions.","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"type":"object","title":"FormDisplay - display options for communication/ask task (for both email and web forms).","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"NotifiableItem":{"type":"object","title":"NotifiableItem ...","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"},"SLA":{"type":"object","title":"SLA ...","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"},"InvestigationPlaybook":{"type":"object","description":"InvestigationPlaybook is a wrapper for a linked list of Playbook tasks","properties":{"Dirty":{"type":"boolean"},"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object"}}},"ReplacedPlaybook":{"type":"boolean","description":"Indicate whether this playbook has new history during this session"},"ShardID":{"type":"integer","format":"int64"},"UpdatedOperatorIDs":{"type":"boolean"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"autoExtracting":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentCreateDate":{"type":"string","description":"Incident create date","format":"date-time"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"invPBDebugInfo":{"$ref":"#/components/schemas/InvPlaybookDebugInfo"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pbHistory":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/InvestigationPlaybookData"}},"pendingTasks":{"type":"object","description":"Tasks that are marked for running, but cannot yet run due to incomplete parents","additionalProperties":{"type":"object"}},"playbookId":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"quiet":{"type":"boolean"},"recoveryAttempts":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"serverId":{"type":"string","description":"Holds the ID of the responsible cluster app server"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"syncHash":{"type":"string"},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"InvPlaybookDebugInfo":{"type":"object","title":"InvPlaybookDebugInfo ...","properties":{"originalInvPBId":{"type":"string"}}},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"},"Task":{"type":"object","description":"Task is the basic task in the task repository that can be associated to an incident via playbook","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}}},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"InvPlaybookTaskCompleteData":{"type":"object","title":"InvPlaybookTaskCompleteData ...","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object"}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object"}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"InvTaskDebug":{"type":"object","title":"InvTaskDebug ...","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object"}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"TimerTrigger":{"type":"object","title":"TimerTrigger ...","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"type":"string","title":"TimerAction ..."},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}}
```

## The InvestigationPlaybookState object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"}}}}
```

## The InvestigationPlaybookTask object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationPlaybookTask":{"type":"object","description":"InvestigationPlaybookTask is the Task in the playbook context as a node","properties":{"Reopen":{"type":"boolean"},"arguments":{"type":"object","additionalProperties":{"type":"object"}},"assignee":{"type":"string"},"assigneeSet":{"type":"boolean"},"blockingTasks":{"type":"array","items":{"type":"string"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"comments":{"type":"boolean","description":"Whether this task had any comments or not"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"doNotSaveTaskHistory":{"type":"boolean"},"dueDate":{"type":"string","format":"date-time"},"dueDateDuration":{"type":"integer","format":"int64"},"dueDateDurationUnit":{"$ref":"#/components/schemas/SLADurationUnit"},"dueDateSet":{"type":"boolean"},"entries":{"type":"array","items":{"type":"string"}},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"executionCount":{"type":"integer","format":"int64"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"forEachIndex":{"type":"integer","description":"Parameters needed for loops","format":"int64"},"forEachInputs":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object"}}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"hasErrorEntries":{"type":"boolean"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"indent":{"type":"integer","format":"int64"},"input":{"type":"string"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"missingContentItem":{"type":"string","description":"content item which caused task to skip"},"nextPollingTime":{"type":"string","description":"NextPollTime Time of the next scheduled command execution","format":"date-time"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"outputs":{"type":"object","additionalProperties":{"type":"object"}},"parentBlockCount":{"type":"integer","description":"the number of tasks that are waiting on blocked in subplaybooks of this task","format":"int64"},"parentPlaybookID":{"type":"string"},"patched":{"type":"boolean","description":"Indicates whether this task was patched to InvPB and did not originally belong to the playbook"},"playbookInputs":{"type":"object","additionalProperties":{"type":"object"}},"pollingEntries":{"type":"array","description":"PollingEntryIDs IDs of entries that are still polling","items":{"type":"string"}},"pollingTimeoutTime":{"type":"string","format":"date-time"},"previousTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reminder":{"type":"integer","description":"Duration in minutes, this field is not persisted here","format":"int64"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skip":{"type":"boolean","description":"Skip - if true then this task will be skipped and all the tasks which comes after this task and depend on it\nwill skip (WillNotExecute)"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"startDate":{"type":"string","format":"date-time"},"startedExecutingHarmfulScript":{"type":"boolean"},"state":{"$ref":"#/components/schemas/TaskState"},"subPlaybook":{"$ref":"#/components/schemas/InvestigationPlaybook"},"task":{"$ref":"#/components/schemas/Task"},"taskCompleteData":{"type":"array","description":"History complete data","items":{"$ref":"#/components/schemas/InvPlaybookTaskCompleteData"}},"taskDebug":{"$ref":"#/components/schemas/InvTaskDebug"},"taskId":{"type":"string"},"taskSize":{"type":"integer","format":"int64"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"timesPolled":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ContinueOnErrorType":{"type":"string","title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path."},"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"},"EvidenceData":{"type":"object","description":"EvidenceData - all evidence properties to evaluate in task process","properties":{"customFields":{"type":"object","description":"This field must have empty json key","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}}},"FieldMapping":{"type":"object","description":"FieldMapping - Map a task output (complex or simple value) to an incident field","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}}},"DataCollectionForm":{"type":"object","title":"DataCollectionForm - a data collection form with questions.","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"type":"object","title":"FormDisplay - display options for communication/ask task (for both email and web forms).","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"NotifiableItem":{"type":"object","title":"NotifiableItem ...","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"},"SLA":{"type":"object","title":"SLA ...","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"},"InvestigationPlaybook":{"type":"object","description":"InvestigationPlaybook is a wrapper for a linked list of Playbook tasks","properties":{"Dirty":{"type":"boolean"},"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object"}}},"ReplacedPlaybook":{"type":"boolean","description":"Indicate whether this playbook has new history during this session"},"ShardID":{"type":"integer","format":"int64"},"UpdatedOperatorIDs":{"type":"boolean"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"autoExtracting":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentCreateDate":{"type":"string","description":"Incident create date","format":"date-time"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"invPBDebugInfo":{"$ref":"#/components/schemas/InvPlaybookDebugInfo"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pbHistory":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/InvestigationPlaybookData"}},"pendingTasks":{"type":"object","description":"Tasks that are marked for running, but cannot yet run due to incomplete parents","additionalProperties":{"type":"object"}},"playbookId":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"quiet":{"type":"boolean"},"recoveryAttempts":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"serverId":{"type":"string","description":"Holds the ID of the responsible cluster app server"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"syncHash":{"type":"string"},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","description":"PlaybookInput represents the playbook input","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}},"InvPlaybookDebugInfo":{"type":"object","title":"InvPlaybookDebugInfo ...","properties":{"originalInvPBId":{"type":"string"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","description":"PlaybookOutput represents the playbook output","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"InvestigationPlaybookData":{"type":"object","description":"InvestigationPlaybookData returns all data of an investigation playbook, not including history","properties":{"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object"}}},"autoExtracting":{"type":"boolean"},"comment":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"name":{"type":"string"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pendingTasks":{"type":"object","description":"Tasks that are marked for running, but cannot yet run due to incomplete parents","additionalProperties":{"type":"object"}},"playbookId":{"type":"string"},"quiet":{"type":"boolean"},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"view":{"$ref":"#/components/schemas/PlaybookView"}}},"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"},"Task":{"type":"object","description":"Task is the basic task in the task repository that can be associated to an incident via playbook","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}}},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"InvPlaybookTaskCompleteData":{"type":"object","title":"InvPlaybookTaskCompleteData ...","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object"}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object"}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"InvTaskDebug":{"type":"object","title":"InvTaskDebug ...","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object"}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"TimerTrigger":{"type":"object","title":"TimerTrigger ...","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"type":"string","title":"TimerAction ..."},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}}
```

## The TaskCondition object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."}}}}
```

## The ContinueOnErrorType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ContinueOnErrorType":{"type":"string","title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path."}}}}
```

## The SLADurationUnit object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"}}}}
```

## The EvidenceData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"EvidenceData":{"type":"object","description":"EvidenceData - all evidence properties to evaluate in task process","properties":{"customFields":{"type":"object","description":"This field must have empty json key","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The FieldMapping object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FieldMapping":{"type":"object","description":"FieldMapping - Map a task output (complex or simple value) to an incident field","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The DataCollectionForm object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"DataCollectionForm":{"type":"object","title":"DataCollectionForm - a data collection form with questions.","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The Question object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```

## The FormDisplay object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"FormDisplay":{"type":"object","title":"FormDisplay - display options for communication/ask task (for both email and web forms).","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}}}}}
```

## The NotifiableItem object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"NotifiableItem":{"type":"object","title":"NotifiableItem ...","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}}}}}
```

## The NotifyTimings object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}}}}}
```

## The QuietMode object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"}}}}
```

## The SLA object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"SLA":{"type":"object","title":"SLA ...","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}}}}}
```

## The TaskState object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"}}}}
```

## The Task object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Task":{"type":"object","description":"Task is the basic task in the task repository that can be associated to an incident via playbook","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}}},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"}}}}
```

## The InvPlaybookTaskCompleteData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvPlaybookTaskCompleteData":{"type":"object","title":"InvPlaybookTaskCompleteData ...","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object"}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object"}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"}}}}
```

## The InvTaskDebug object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvTaskDebug":{"type":"object","title":"InvTaskDebug ...","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object"}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."}}}}
```

## The TimerTrigger object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TimerTrigger":{"type":"object","title":"TimerTrigger ...","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"type":"string","title":"TimerAction ..."}}}}
```

## The TimerAction object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TimerAction":{"type":"string","title":"TimerAction ..."}}}}
```

## The TaskView object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}}
```

## The PlaybookView object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}}
```

## The invPlaybookAssignee object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"invPlaybookAssignee":{"type":"object","properties":{"assignee":{"type":"string"},"inTaskID":{"type":"string"},"invId":{"type":"string"},"version":{"type":"integer","format":"int64"}}}}}}
```

## The invTaskInfo object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"invTaskInfo":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"comment":{"type":"string"},"conditions":{"type":"array","items":{"$ref":"#/components/schemas/TaskCondition"}},"inTaskID":{"type":"string"},"input":{"type":"string"},"invId":{"type":"string"},"loopArgs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"loopCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"version":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}}}}}
```

## The invPlaybookDue object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"invPlaybookDue":{"type":"object","properties":{"date":{"type":"string","format":"date-time"},"inTaskID":{"type":"string"},"invId":{"type":"string"},"version":{"type":"integer","format":"int64"}}}}}}
```

## The SearchInvestigationsData object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"SearchInvestigationsData":{"type":"object","title":"SearchInvestigationsData ...","properties":{"filter":{"$ref":"#/components/schemas/InvestigationFilter"}}},"InvestigationFilter":{"type":"object","title":"InvestigationFilter allows for very simple filtering.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"fromCloseDate":{"type":"string","format":"date-time"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"idsOnly":{"type":"boolean"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"includeChildInv":{"type":"boolean"},"name":{"type":"array","items":{"type":"string"}},"notCategory":{"type":"array","items":{"type":"string"}},"notIDs":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"reason":{"type":"array","items":{"type":"string"}},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/InvestigationStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toCloseDate":{"type":"string","format":"date-time"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"$ref":"#/components/schemas/InvestigationType"}},"user":{"type":"array","items":{"type":"string"}}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"InvestigationStatus":{"type":"number","description":"InvestigationStatus is the status type","format":"double"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"InvestigationType":{"type":"number","title":"InvestigationType ...","format":"double"}}}}
```

## The InvestigationFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationFilter":{"type":"object","title":"InvestigationFilter allows for very simple filtering.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"fromCloseDate":{"type":"string","format":"date-time"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"idsOnly":{"type":"boolean"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"includeChildInv":{"type":"boolean"},"name":{"type":"array","items":{"type":"string"}},"notCategory":{"type":"array","items":{"type":"string"}},"notIDs":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"reason":{"type":"array","items":{"type":"string"}},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/InvestigationStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toCloseDate":{"type":"string","format":"date-time"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"$ref":"#/components/schemas/InvestigationType"}},"user":{"type":"array","items":{"type":"string"}}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"InvestigationStatus":{"type":"number","description":"InvestigationStatus is the status type","format":"double"},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"},"InvestigationType":{"type":"number","title":"InvestigationType ...","format":"double"}}}}
```

## The InvestigationStatus object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationStatus":{"type":"number","description":"InvestigationStatus is the status type","format":"double"}}}}
```

## The InvestigationType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationType":{"type":"number","title":"InvestigationType ...","format":"double"}}}}
```

## The InvestigationSearchResponse object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"InvestigationSearchResponse":{"type":"object","description":"InvestigationSearchResponse returns the response from the investigation search","properties":{"data":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/Investigation"}},"total":{"type":"integer","format":"int64"}}},"Investigation":{"type":"object","title":"Investigation contains the investigation of a particular incident.","description":"A special investigation called playground is created for each user-project combination and is a private space for the researcher to play in.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string","description":"Category of the investigation"},"childInvestigations":{"type":"array","description":"ChildInvestigations id's","items":{"type":"string"}},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"creatingUserId":{"type":"string","description":"The user ID that created this investigation"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"details":{"type":"string","description":"User defined free text details"},"entitlements":{"type":"array","description":"One time entitlements","items":{"type":"string"}},"entryUsers":{"type":"array","description":"EntryUsers","items":{"type":"string"}},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highPriority":{"type":"boolean","description":"HighPriority - tasks of this investigation should run in high priority"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isChildInvestigation":{"type":"boolean","description":"IsChildInvestigation"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"lastOpen":{"type":"string","format":"date-time"},"mirrorAutoClose":{"type":"object","description":"MirrorAutoClose will tell us to close the Chat Module channel if we close investigation","additionalProperties":{"type":"boolean"}},"mirrorTypes":{"type":"object","description":"MirrorTypes holds info about mirror direction and message type to be mirrored\nmessage type can be either 'all' or 'chat'\ndirection can be either 'FromDemisto', 'ToDemisto' or 'Both' if this investigation is mirrored","additionalProperties":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"The name of the investigation, which is unique to the project"},"numericId":{"type":"integer","format":"int64"},"openDuration":{"type":"integer","description":"Duration from open to close time","format":"int64"},"parentInvestigation":{"type":"string","description":"ParentInvestigation - parent id, in case this is a child investigation of another investigation"},"persistentEntitlements":{"type":"object","description":"Persistent entitlement per tag. Empty tag will also return an entitlement","additionalProperties":{"type":"string"}},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"reason":{"type":"object","description":"The reason for the status (resolve)","additionalProperties":{"type":"string"}},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"slackMirrorAutoClose":{"type":"boolean","description":"DEPRECATED - DeprecatedSlackMirrorAutoClose will tell us to close the Slack channel if we close investigation"},"slackMirrorType":{"type":"string","description":"DEPRECATED - DeprecatedSlackMirrorType holds info about mirror direction and message type to be mirror\nmessage type can be either 'all' or 'chat'\ndirection can be either 'demisto2Slack', 'slack2Demisto' or 'both' if this investigation is mirrored to Slack"},"sortValues":{"type":"array","items":{"type":"string"}},"status":{"$ref":"#/components/schemas/InvestigationStatus"},"syncHash":{"type":"string"},"systems":{"type":"array","description":"The systems involved","items":{"$ref":"#/components/schemas/System"}},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/InvestigationType"},"users":{"type":"array","description":"The users who share this investigation","items":{"type":"string"}},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"RunStatus":{"type":"string","description":"RunStatus of a job"},"InvestigationStatus":{"type":"number","description":"InvestigationStatus is the status type","format":"double"},"System":{"type":"object","description":"System - URL stands for ip or hostname","properties":{"agent":{"$ref":"#/components/schemas/SystemAgent"},"arch":{"type":"string"},"ciphers":{"type":"array","items":{"type":"string"}},"credentials":{"type":"string"},"engineId":{"type":"string"},"host":{"type":"string"},"integrationinstanceid":{"type":"string"},"issharedagent":{"type":"boolean"},"name":{"type":"string"},"os":{"type":"string"},"password":{"type":"string"},"servicesID":{"type":"string"},"smb":{"type":"integer","format":"int64"},"smbport":{"type":"integer","format":"uint16"},"sshkey":{"type":"string"},"sshport":{"type":"integer","format":"uint16"},"terminalOptions":{"$ref":"#/components/schemas/TerminalOptions"},"user":{"type":"string"},"workgroup":{"type":"string"}}},"SystemAgent":{"type":"object","description":"SystemAgent - represents agent status and holds server context","properties":{"servercontext":{"type":"array","items":{"type":"integer","format":"uint8"}}}},"TerminalOptions":{"type":"object","description":"TerminalOptions - terminal options to use in case of using pty","properties":{"Echo":{"type":"integer","format":"uint32"},"Terminal":{"type":"boolean"},"TerminalHeight":{"type":"integer","format":"int64"},"TerminalType":{"type":"string"},"TerminalWidth":{"type":"integer","format":"int64"},"TyISpeed":{"type":"integer","format":"uint32"},"TyOSpeed":{"type":"integer","format":"uint32"}}},"InvestigationType":{"type":"number","title":"InvestigationType ...","format":"double"}}}}
```

## The Investigation object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Investigation":{"type":"object","title":"Investigation contains the investigation of a particular incident.","description":"A special investigation called playground is created for each user-project combination and is a private space for the researcher to play in.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string","description":"Category of the investigation"},"childInvestigations":{"type":"array","description":"ChildInvestigations id's","items":{"type":"string"}},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"creatingUserId":{"type":"string","description":"The user ID that created this investigation"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"details":{"type":"string","description":"User defined free text details"},"entitlements":{"type":"array","description":"One time entitlements","items":{"type":"string"}},"entryUsers":{"type":"array","description":"EntryUsers","items":{"type":"string"}},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highPriority":{"type":"boolean","description":"HighPriority - tasks of this investigation should run in high priority"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isChildInvestigation":{"type":"boolean","description":"IsChildInvestigation"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"lastOpen":{"type":"string","format":"date-time"},"mirrorAutoClose":{"type":"object","description":"MirrorAutoClose will tell us to close the Chat Module channel if we close investigation","additionalProperties":{"type":"boolean"}},"mirrorTypes":{"type":"object","description":"MirrorTypes holds info about mirror direction and message type to be mirrored\nmessage type can be either 'all' or 'chat'\ndirection can be either 'FromDemisto', 'ToDemisto' or 'Both' if this investigation is mirrored","additionalProperties":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"The name of the investigation, which is unique to the project"},"numericId":{"type":"integer","format":"int64"},"openDuration":{"type":"integer","description":"Duration from open to close time","format":"int64"},"parentInvestigation":{"type":"string","description":"ParentInvestigation - parent id, in case this is a child investigation of another investigation"},"persistentEntitlements":{"type":"object","description":"Persistent entitlement per tag. Empty tag will also return an entitlement","additionalProperties":{"type":"string"}},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"reason":{"type":"object","description":"The reason for the status (resolve)","additionalProperties":{"type":"string"}},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"slackMirrorAutoClose":{"type":"boolean","description":"DEPRECATED - DeprecatedSlackMirrorAutoClose will tell us to close the Slack channel if we close investigation"},"slackMirrorType":{"type":"string","description":"DEPRECATED - DeprecatedSlackMirrorType holds info about mirror direction and message type to be mirror\nmessage type can be either 'all' or 'chat'\ndirection can be either 'demisto2Slack', 'slack2Demisto' or 'both' if this investigation is mirrored to Slack"},"sortValues":{"type":"array","items":{"type":"string"}},"status":{"$ref":"#/components/schemas/InvestigationStatus"},"syncHash":{"type":"string"},"systems":{"type":"array","description":"The systems involved","items":{"$ref":"#/components/schemas/System"}},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/InvestigationType"},"users":{"type":"array","description":"The users who share this investigation","items":{"type":"string"}},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"RunStatus":{"type":"string","description":"RunStatus of a job"},"InvestigationStatus":{"type":"number","description":"InvestigationStatus is the status type","format":"double"},"System":{"type":"object","description":"System - URL stands for ip or hostname","properties":{"agent":{"$ref":"#/components/schemas/SystemAgent"},"arch":{"type":"string"},"ciphers":{"type":"array","items":{"type":"string"}},"credentials":{"type":"string"},"engineId":{"type":"string"},"host":{"type":"string"},"integrationinstanceid":{"type":"string"},"issharedagent":{"type":"boolean"},"name":{"type":"string"},"os":{"type":"string"},"password":{"type":"string"},"servicesID":{"type":"string"},"smb":{"type":"integer","format":"int64"},"smbport":{"type":"integer","format":"uint16"},"sshkey":{"type":"string"},"sshport":{"type":"integer","format":"uint16"},"terminalOptions":{"$ref":"#/components/schemas/TerminalOptions"},"user":{"type":"string"},"workgroup":{"type":"string"}}},"SystemAgent":{"type":"object","description":"SystemAgent - represents agent status and holds server context","properties":{"servercontext":{"type":"array","items":{"type":"integer","format":"uint8"}}}},"TerminalOptions":{"type":"object","description":"TerminalOptions - terminal options to use in case of using pty","properties":{"Echo":{"type":"integer","format":"uint32"},"Terminal":{"type":"boolean"},"TerminalHeight":{"type":"integer","format":"int64"},"TerminalType":{"type":"string"},"TerminalWidth":{"type":"integer","format":"int64"},"TyISpeed":{"type":"integer","format":"uint32"},"TyOSpeed":{"type":"integer","format":"uint32"}}},"InvestigationType":{"type":"number","title":"InvestigationType ...","format":"double"}}}}
```

## The System object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"System":{"type":"object","description":"System - URL stands for ip or hostname","properties":{"agent":{"$ref":"#/components/schemas/SystemAgent"},"arch":{"type":"string"},"ciphers":{"type":"array","items":{"type":"string"}},"credentials":{"type":"string"},"engineId":{"type":"string"},"host":{"type":"string"},"integrationinstanceid":{"type":"string"},"issharedagent":{"type":"boolean"},"name":{"type":"string"},"os":{"type":"string"},"password":{"type":"string"},"servicesID":{"type":"string"},"smb":{"type":"integer","format":"int64"},"smbport":{"type":"integer","format":"uint16"},"sshkey":{"type":"string"},"sshport":{"type":"integer","format":"uint16"},"terminalOptions":{"$ref":"#/components/schemas/TerminalOptions"},"user":{"type":"string"},"workgroup":{"type":"string"}}},"SystemAgent":{"type":"object","description":"SystemAgent - represents agent status and holds server context","properties":{"servercontext":{"type":"array","items":{"type":"integer","format":"uint8"}}}},"TerminalOptions":{"type":"object","description":"TerminalOptions - terminal options to use in case of using pty","properties":{"Echo":{"type":"integer","format":"uint32"},"Terminal":{"type":"boolean"},"TerminalHeight":{"type":"integer","format":"int64"},"TerminalType":{"type":"string"},"TerminalWidth":{"type":"integer","format":"int64"},"TyISpeed":{"type":"integer","format":"uint32"},"TyOSpeed":{"type":"integer","format":"uint32"}}}}}}
```

## The SystemAgent object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"SystemAgent":{"type":"object","description":"SystemAgent - represents agent status and holds server context","properties":{"servercontext":{"type":"array","items":{"type":"integer","format":"uint8"}}}}}}}
```

## The TerminalOptions object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"TerminalOptions":{"type":"object","description":"TerminalOptions - terminal options to use in case of using pty","properties":{"Echo":{"type":"integer","format":"uint32"},"Terminal":{"type":"boolean"},"TerminalHeight":{"type":"integer","format":"int64"},"TerminalType":{"type":"string"},"TerminalWidth":{"type":"integer","format":"int64"},"TyISpeed":{"type":"integer","format":"uint32"},"TyOSpeed":{"type":"integer","format":"uint32"}}}}}}
```

## The playbookWithWarnings object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"playbookWithWarnings":{"type":"object","properties":{"playbook":{"$ref":"#/components/schemas/Playbook"},"warnings":{"type":"array","items":{"type":"string"}}}},"Playbook":{"type":"object","description":"Playbook is a collection of tasks","properties":{"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"brands":{"type":"array","items":{"type":"string"}},"cacheVersn":{"type":"integer","format":"int64"},"commands":{"type":"array","items":{"type":"string"}},"comment":{"type":"string"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"encTasks":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"missingScriptsIds":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"nameRaw":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"quiet":{"type":"boolean"},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scriptIds":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourcePlaybookID":{"type":"string"},"startTaskId":{"type":"string"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"taskIds":{"type":"array","description":"auto generated field that will contain all task ids in this playbook\nNeeded for searching with bleve","items":{"type":"string"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookTask"}},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","description":"PlaybookInput represents the playbook input","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","description":"PlaybookOutput represents the playbook output","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"PlaybookTask":{"type":"object","title":"PlaybookTask ...","properties":{"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"task":{"$ref":"#/components/schemas/Task"},"taskId":{"type":"string"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"}}},"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}},"ContinueOnErrorType":{"type":"string","title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path."},"EvidenceData":{"type":"object","description":"EvidenceData - all evidence properties to evaluate in task process","properties":{"customFields":{"type":"object","description":"This field must have empty json key","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}}},"FieldMapping":{"type":"object","description":"FieldMapping - Map a task output (complex or simple value) to an incident field","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}}},"DataCollectionForm":{"type":"object","title":"DataCollectionForm - a data collection form with questions.","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"type":"object","title":"FormDisplay - display options for communication/ask task (for both email and web forms).","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"NotifiableItem":{"type":"object","title":"NotifiableItem ...","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"},"SLA":{"type":"object","title":"SLA ...","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"Task":{"type":"object","description":"Task is the basic task in the task repository that can be associated to an incident via playbook","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}}},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"TimerTrigger":{"type":"object","title":"TimerTrigger ...","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"type":"string","title":"TimerAction ..."},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}}
```

## The Playbook object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Playbook":{"type":"object","description":"Playbook is a collection of tasks","properties":{"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"brands":{"type":"array","items":{"type":"string"}},"cacheVersn":{"type":"integer","format":"int64"},"commands":{"type":"array","items":{"type":"string"}},"comment":{"type":"string"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"encTasks":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"missingScriptsIds":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"nameRaw":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"quiet":{"type":"boolean"},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scriptIds":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourcePlaybookID":{"type":"string"},"startTaskId":{"type":"string"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"taskIds":{"type":"array","description":"auto generated field that will contain all task ids in this playbook\nNeeded for searching with bleve","items":{"type":"string"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookTask"}},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","description":"PlaybookInput represents the playbook input","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookInputQuery":{"type":"object","description":"PlaybookInputQuery represents the playbook query input","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object"},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"QueryState":{"type":"object","description":"QueryState represents the playbook query state","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","description":"PlaybookOutput represents the playbook output","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"PlaybookTask":{"type":"object","title":"PlaybookTask ...","properties":{"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"task":{"$ref":"#/components/schemas/Task"},"taskId":{"type":"string"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"}}},"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}},"ContinueOnErrorType":{"type":"string","title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path."},"EvidenceData":{"type":"object","description":"EvidenceData - all evidence properties to evaluate in task process","properties":{"customFields":{"type":"object","description":"This field must have empty json key","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}}},"FieldMapping":{"type":"object","description":"FieldMapping - Map a task output (complex or simple value) to an incident field","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}}},"DataCollectionForm":{"type":"object","title":"DataCollectionForm - a data collection form with questions.","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"type":"object","title":"FormDisplay - display options for communication/ask task (for both email and web forms).","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"NotifiableItem":{"type":"object","title":"NotifiableItem ...","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"},"SLA":{"type":"object","title":"SLA ...","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"Task":{"type":"object","description":"Task is the basic task in the task repository that can be associated to an incident via playbook","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}}},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"TimerTrigger":{"type":"object","title":"TimerTrigger ...","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"type":"string","title":"TimerAction ..."},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}}
```

## The PlaybookTask object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"PlaybookTask":{"type":"object","title":"PlaybookTask ...","properties":{"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"task":{"$ref":"#/components/schemas/Task"},"taskId":{"type":"string"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"}}},"TaskCondition":{"type":"object","description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","description":"ArgAtomicFilter - operator with two sides that return true/false","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}}},"OperatorArgument":{"type":"object","title":"OperatorArgument ...","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"type":"object","title":"AdvanceArg - advance argument can be one of the following:","description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}}},"ComplexArg":{"type":"object","description":"ComplexArg - all info that is necessary to compute argument value from context\nRoot - the root slice (or object) from to work against\nFilters - a slice of filters to apply to the root object, one after another (e.i. with AND condition between each one)\nAccessor - the key to access to each result after filter\nTransformers - a slice to transformers to apply on the result of the accessed key from each result\ne.g. if user want to take from context all File.DisplayName where File.Extension is 'EXE', and the result in uppercase than:\nRoot: is \"File\"\nFilters: will hold the \"File.DisplayName where File.Extension is 'EXE'\" query\nAccessor: is \"DisplayName\"\nTransformers: will hold the uppercase transformation","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}}},"ArgTransformer":{"type":"object","title":"ArgTransformer ...","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"type":"string","title":"TransformerOperatorID ..."},"KeyValueArg":{"type":"object","title":"KeyValueArg ...","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"type":"string","title":"FilterOperatorID ..."},"ContinueOnErrorType":{"type":"string","title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path."},"EvidenceData":{"type":"object","description":"EvidenceData - all evidence properties to evaluate in task process","properties":{"customFields":{"type":"object","description":"This field must have empty json key","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}}},"FieldMapping":{"type":"object","description":"FieldMapping - Map a task output (complex or simple value) to an incident field","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}}},"DataCollectionForm":{"type":"object","title":"DataCollectionForm - a data collection form with questions.","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"type":"object","title":"Question - question for a form with a given type.","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"type":"object","title":"GridColumn ...","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"type":"object","title":"FormDisplay - display options for communication/ask task (for both email and web forms).","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","description":"TaskLoop contains loop details","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}}},"NotifiableItem":{"type":"object","title":"NotifiableItem ...","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"type":"object","title":"NotifyTimings - time control on notify items - retries max count and intervals.","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","title":"ReputationCalcAlg ...","format":"double"},"SLA":{"type":"object","title":"SLA ...","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"Task":{"type":"object","description":"Task is the basic task in the task repository that can be associated to an incident via playbook","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}}},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"TimerTrigger":{"type":"object","title":"TimerTrigger ...","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"type":"string","title":"TimerAction ..."},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}}
```

## The Report object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Report":{"type":"object","description":"Report - represents report","properties":{"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"createdBy":{"type":"string"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dashboard":{"$ref":"#/components/schemas/Dashboard"},"decoder":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/ReportFieldsDecoder"}},"definitionId":{"type":"string"},"description":{"type":"string"},"disableHeader":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"latestReportName":{"type":"string"},"latestReportTime":{"type":"string","format":"date-time"},"latestReportUsername":{"type":"string"},"latestScheduledReportTime":{"type":"string","format":"date-time"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"nextScheduledTime":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"orientation":{"type":"string"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"paperSize":{"type":"string"},"prevName":{"type":"string"},"prevType":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"recipients":{"type":"array","items":{"type":"string"}},"recurrent":{"type":"boolean"},"remote":{"type":"boolean"},"reportType":{"type":"string"},"runOnce":{"type":"boolean"},"runningRoles":{"type":"array","items":{"type":"string"}},"runningUser":{"type":"string"},"scheduled":{"type":"boolean","description":"is it scheduled"},"sections":{"type":"array","items":{"$ref":"#/components/schemas/Section"}},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"times":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"type":"string"},"userAPIKey":{"type":"string"},"userAPIKeyID":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Dashboard":{"type":"object","title":"Dashboard ...","properties":{"accounts":{"type":"object","additionalProperties":{"type":"object"}},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidePivot":{"type":"boolean"},"hideSearch":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommon":{"type":"boolean"},"itemVersion":{"$ref":"#/components/schemas/Version"},"layout":{"$ref":"#/components/schemas/WidgetCells"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"modulePage":{"type":"boolean"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"owner":{"type":"string"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"period":{"$ref":"#/components/schemas/Period"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"WidgetCells":{"type":"array","title":"WidgetCells ...","items":{"$ref":"#/components/schemas/WidgetCell"}},"WidgetCell":{"type":"object","title":"WidgetCell ...","properties":{"forceRange":{"type":"boolean"},"h":{"type":"integer","format":"int64"},"i":{"type":"string"},"id":{"type":"string"},"reflectDimensions":{"type":"boolean"},"w":{"type":"integer","format":"int64"},"widget":{"$ref":"#/components/schemas/Widget"},"x":{"type":"integer","format":"int64"},"y":{"type":"integer","format":"int64"}}},"Widget":{"type":"object","description":"Widget describe a widget component used to get statistics requests, based on parameters such as\ndataType and widgetType. A widget can be a part of widgets collection inside a dashboard.","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","description":"Accounts list of accounts to query the widget data from","additionalProperties":{"type":"object"}},"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string","description":"Category the widget is related to. Used to display in widget library under category or dataType if empty."},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dataType":{"type":"string","description":"Data type of the widget. Describes what data does the widget query. supporting data types \"incidents\",\"messages\",\"system\",\"entries\",\"tasks\", \"audit\"."},"dateRange":{"$ref":"#/components/schemas/DateRange"},"definition":{"$ref":"#/components/schemas/GenericObjectDefinition"},"definitionId":{"type":"string"},"description":{"type":"string","description":"The description of the widget's usage and data representation."},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"indexName":{"type":"string"},"isPredefined":{"type":"boolean","description":"Is the widget a system widget."},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean","description":"Is the widget locked for editing."},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Default name of the widget."},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"params":{"type":"object","description":"Additional parameters for this widget, depends on widget type and data.","additionalProperties":{"type":"object"}},"prevName":{"type":"string","description":"The previous name of the widget."},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"query":{"type":"string","description":"Query to search on the dataType."},"remote":{"type":"boolean"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"skipAggregateAccounts":{"type":"boolean","description":"SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"widgetType":{"type":"string","description":"Widget type describes how does the widget should recieve the data, and display it. Supporting types: \"bar\", \"column\", \"pie\", \"list\", \"number\", \"trend\", \"text\", \"duration\", \"image\", \"line\", and \"table\"."}},"required":["name","widgetType"]},"DateRange":{"type":"object","description":"DateRange provides common fields for date filtering","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"toDate":{"type":"string","format":"date-time"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"GenericObjectDefinition":{"type":"object","title":"GenericObjectDefinition ...","properties":{"auditable":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"definitionId":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"partitioned":{"type":"boolean"},"pluralName":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"rbacSupport":{"type":"boolean"},"remote":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"ReportFieldsDecoder":{"type":"object","title":"ReportFieldsDecoder ...","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"HumanCron":{"type":"object","title":"HumanCron ...","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"Section":{"type":"object","title":"Section ...","properties":{"autoPageBreak":{"type":"boolean"},"automation":{"$ref":"#/components/schemas/ReportAutomation"},"data":{"type":"object"},"description":{"type":"string"},"displayType":{"type":"string"},"emptyNotification":{"type":"string"},"fromDate":{"type":"string"},"hideItemTitleOnlyOne":{"type":"boolean"},"layout":{"type":"object"},"query":{"$ref":"#/components/schemas/ReportQuery"},"title":{"type":"string"},"titleStyle":{"type":"object","additionalProperties":{"type":"object"}},"toDate":{"type":"string"},"type":{"type":"string"}}},"ReportAutomation":{"type":"object","title":"ReportAutomation ...","properties":{"args":{"$ref":"#/components/schemas/ModuleArgs"},"id":{"type":"string"},"name":{"type":"string"},"noEvent":{"type":"boolean"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"ReportQuery":{"type":"object","title":"ReportQuery ...","properties":{"customGroupBy":{"$ref":"#/components/schemas/CustomGroups"},"filter":{"type":"object"},"groupBy":{"type":"array","items":{"type":"string"}},"keys":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"valuesFormat":{"type":"string"}}},"CustomGroups":{"type":"array","description":"CustomGroups - a custom group for each group-by element","items":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/CustomGroup"}}},"CustomGroup":{"type":"object","description":"CustomGroup - A new custom group that will be created by merging groups based on the Conditions","properties":{"conditions":{"type":"array","items":{"$ref":"#/components/schemas/Buckets"}},"name":{"type":"string"}}},"Buckets":{"type":"array","title":"Buckets - Array of conditional buckets, related by 'OR'","items":{"$ref":"#/components/schemas/Bucket"}},"Bucket":{"type":"object","title":"Bucket - represents a specific condition term for merging groups into a custom group.","properties":{"field":{"type":"string"},"operator":{"type":"string"},"right":{"type":"string"},"type":{"$ref":"#/components/schemas/OperatorType"}}},"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The ReportFieldsDecoder object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ReportFieldsDecoder":{"type":"object","title":"ReportFieldsDecoder ...","properties":{"type":{"type":"string"},"value":{"type":"string"}}}}}}
```

## The Section object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Section":{"type":"object","title":"Section ...","properties":{"autoPageBreak":{"type":"boolean"},"automation":{"$ref":"#/components/schemas/ReportAutomation"},"data":{"type":"object"},"description":{"type":"string"},"displayType":{"type":"string"},"emptyNotification":{"type":"string"},"fromDate":{"type":"string"},"hideItemTitleOnlyOne":{"type":"boolean"},"layout":{"type":"object"},"query":{"$ref":"#/components/schemas/ReportQuery"},"title":{"type":"string"},"titleStyle":{"type":"object","additionalProperties":{"type":"object"}},"toDate":{"type":"string"},"type":{"type":"string"}}},"ReportAutomation":{"type":"object","title":"ReportAutomation ...","properties":{"args":{"$ref":"#/components/schemas/ModuleArgs"},"id":{"type":"string"},"name":{"type":"string"},"noEvent":{"type":"boolean"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}},"ReportQuery":{"type":"object","title":"ReportQuery ...","properties":{"customGroupBy":{"$ref":"#/components/schemas/CustomGroups"},"filter":{"type":"object"},"groupBy":{"type":"array","items":{"type":"string"}},"keys":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"valuesFormat":{"type":"string"}}},"CustomGroups":{"type":"array","description":"CustomGroups - a custom group for each group-by element","items":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/CustomGroup"}}},"CustomGroup":{"type":"object","description":"CustomGroup - A new custom group that will be created by merging groups based on the Conditions","properties":{"conditions":{"type":"array","items":{"$ref":"#/components/schemas/Buckets"}},"name":{"type":"string"}}},"Buckets":{"type":"array","title":"Buckets - Array of conditional buckets, related by 'OR'","items":{"$ref":"#/components/schemas/Bucket"}},"Bucket":{"type":"object","title":"Bucket - represents a specific condition term for merging groups into a custom group.","properties":{"field":{"type":"string"},"operator":{"type":"string"},"right":{"type":"string"},"type":{"$ref":"#/components/schemas/OperatorType"}}},"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The ReportAutomation object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ReportAutomation":{"type":"object","title":"ReportAutomation ...","properties":{"args":{"$ref":"#/components/schemas/ModuleArgs"},"id":{"type":"string"},"name":{"type":"string"},"noEvent":{"type":"boolean"}}},"ModuleArgs":{"type":"object","description":"ModuleArgs represents module args","additionalProperties":{"type":"object"}}}}}
```

## The ReportQuery object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ReportQuery":{"type":"object","title":"ReportQuery ...","properties":{"customGroupBy":{"$ref":"#/components/schemas/CustomGroups"},"filter":{"type":"object"},"groupBy":{"type":"array","items":{"type":"string"}},"keys":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"valuesFormat":{"type":"string"}}},"CustomGroups":{"type":"array","description":"CustomGroups - a custom group for each group-by element","items":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/CustomGroup"}}},"CustomGroup":{"type":"object","description":"CustomGroup - A new custom group that will be created by merging groups based on the Conditions","properties":{"conditions":{"type":"array","items":{"$ref":"#/components/schemas/Buckets"}},"name":{"type":"string"}}},"Buckets":{"type":"array","title":"Buckets - Array of conditional buckets, related by 'OR'","items":{"$ref":"#/components/schemas/Bucket"}},"Bucket":{"type":"object","title":"Bucket - represents a specific condition term for merging groups into a custom group.","properties":{"field":{"type":"string"},"operator":{"type":"string"},"right":{"type":"string"},"type":{"$ref":"#/components/schemas/OperatorType"}}},"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The CustomGroups object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"CustomGroups":{"type":"array","description":"CustomGroups - a custom group for each group-by element","items":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/CustomGroup"}}},"CustomGroup":{"type":"object","description":"CustomGroup - A new custom group that will be created by merging groups based on the Conditions","properties":{"conditions":{"type":"array","items":{"$ref":"#/components/schemas/Buckets"}},"name":{"type":"string"}}},"Buckets":{"type":"array","title":"Buckets - Array of conditional buckets, related by 'OR'","items":{"$ref":"#/components/schemas/Bucket"}},"Bucket":{"type":"object","title":"Bucket - represents a specific condition term for merging groups into a custom group.","properties":{"field":{"type":"string"},"operator":{"type":"string"},"right":{"type":"string"},"type":{"$ref":"#/components/schemas/OperatorType"}}},"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The CustomGroup object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"CustomGroup":{"type":"object","description":"CustomGroup - A new custom group that will be created by merging groups based on the Conditions","properties":{"conditions":{"type":"array","items":{"$ref":"#/components/schemas/Buckets"}},"name":{"type":"string"}}},"Buckets":{"type":"array","title":"Buckets - Array of conditional buckets, related by 'OR'","items":{"$ref":"#/components/schemas/Bucket"}},"Bucket":{"type":"object","title":"Bucket - represents a specific condition term for merging groups into a custom group.","properties":{"field":{"type":"string"},"operator":{"type":"string"},"right":{"type":"string"},"type":{"$ref":"#/components/schemas/OperatorType"}}},"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The Buckets object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Buckets":{"type":"array","title":"Buckets - Array of conditional buckets, related by 'OR'","items":{"$ref":"#/components/schemas/Bucket"}},"Bucket":{"type":"object","title":"Bucket - represents a specific condition term for merging groups into a custom group.","properties":{"field":{"type":"string"},"operator":{"type":"string"},"right":{"type":"string"},"type":{"$ref":"#/components/schemas/OperatorType"}}},"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The Bucket object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Bucket":{"type":"object","title":"Bucket - represents a specific condition term for merging groups into a custom group.","properties":{"field":{"type":"string"},"operator":{"type":"string"},"right":{"type":"string"},"type":{"$ref":"#/components/schemas/OperatorType"}}},"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The OperatorType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"OperatorType":{"type":"string","title":"OperatorType ..."}}}}
```

## The auditResult object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"auditResult":{"type":"object","properties":{"audits":{"type":"array","items":{"$ref":"#/components/schemas/Audit"}},"total":{"type":"integer","format":"int64"}}},"Audit":{"type":"object","description":"Audit holds the auditing details. This includes all common fields, the action in a string blob and the user who\nperformed the action in a user struct.","properties":{"action":{"type":"object","additionalProperties":{"type":"object"}},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"identifier":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"object":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"type":{"type":"string"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}}}}}
```

## The Audit object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Audit":{"type":"object","description":"Audit holds the auditing details. This includes all common fields, the action in a string blob and the user who\nperformed the action in a user struct.","properties":{"action":{"type":"object","additionalProperties":{"type":"object"}},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"identifier":{"type":"string"},"indexName":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"object":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"type":{"type":"string"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}}}}}
```

## The DockerImagesResult object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"DockerImagesResult":{"type":"object","description":"DockerImagesResult for the get images request","properties":{"images":{"type":"array","items":{"$ref":"#/components/schemas/DockerImage"}}}},"DockerImage":{"type":"object","description":"DockerImage details","properties":{"createdAt":{"type":"string"},"createdSince":{"type":"string"},"id":{"type":"string"},"repository":{"type":"string"},"size":{"type":"string"},"tag":{"type":"string"}}}}}}
```

## The DockerImage object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"DockerImage":{"type":"object","description":"DockerImage details","properties":{"createdAt":{"type":"string"},"createdSince":{"type":"string"},"id":{"type":"string"},"repository":{"type":"string"},"size":{"type":"string"},"tag":{"type":"string"}}}}}}
```

## The NewDockerImage object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"NewDockerImage":{"type":"object","description":"NewDockerImage creation request","properties":{"base":{"type":"string"},"dependencies":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"packages":{"type":"array","items":{"type":"string"}}}}}}}
```

## The NewDockerImageResult object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"NewDockerImageResult":{"type":"object","description":"NewDockerImageResult of the command","properties":{"createdName":{"type":"string"},"output":{"type":"string"}}}}}}
```

## The ModuleConfiguration object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ModuleConfiguration":{"type":"object","description":"ModuleConfiguration is the configuration parameters for a module","properties":{"beta":{"type":"boolean"},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"canGetSamples":{"type":"boolean"},"category":{"type":"string"},"cmdline":{"type":"string"},"commitMessage":{"type":"string"},"configuration":{"type":"array","items":{"$ref":"#/components/schemas/ConfigField"}},"created":{"type":"string","format":"date-time"},"defaultClassifier":{"type":"string"},"defaultMapperIn":{"type":"string"},"defaultMapperOut":{"type":"string"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"detailedDescription":{"type":"string"},"display":{"type":"string"},"executable":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hidden":{"type":"boolean"},"hideEngines":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"icon":{"type":"string"},"id":{"type":"string"},"image":{"type":"string"},"indexName":{"type":"string"},"integrationScript":{"$ref":"#/components/schemas/IntegrationScript"},"isPasswordProtected":{"type":"boolean"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"path":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"readonly":{"type":"boolean"},"remote":{"type":"boolean"},"scriptNotVisible":{"type":"boolean"},"sectionOrder":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceModuleID":{"type":"string"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"videos":{"type":"array","items":{"type":"string"}}}},"ConfigField":{"type":"object","description":"ConfigField holds a configuration field","properties":{"advanced":{"type":"boolean"},"defaultValue":{"type":"string"},"display":{"type":"string"},"displayPassword":{"type":"string"},"hidden":{"type":"boolean"},"hiddenPassword":{"type":"boolean"},"hiddenUsername":{"type":"boolean"},"info":{"type":"string"},"name":{"type":"string"},"options":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"section":{"type":"string"},"type":{"$ref":"#/components/schemas/ConfigDataType"}}},"ConfigDataType":{"type":"number","description":"ConfigDataType holds the type of a configuration field or command argument","format":"double"},"Version":{"type":"object","title":"Version represents a version.","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}}},"IntegrationScript":{"type":"object","title":"IntegrationScript ...","properties":{"commands":{"type":"array","items":{"$ref":"#/components/schemas/Command"}},"dockerImage":{"type":"string"},"feed":{"type":"boolean"},"isFetch":{"type":"boolean"},"isFetchCredentials":{"type":"boolean"},"isFetchEvents":{"type":"boolean"},"isFetchSamples":{"type":"boolean"},"isMappable":{"type":"boolean"},"isRemoteSyncIn":{"type":"boolean"},"isRemoteSyncOut":{"type":"boolean"},"longRunning":{"type":"boolean"},"longRunningPortMapping":{"type":"boolean"},"resetContext":{"type":"boolean"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"type":{"$ref":"#/components/schemas/ScriptType"}}},"Command":{"type":"object","description":"Command supported by a module","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cartesian":{"type":"boolean"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"docsHidden":{"type":"boolean"},"execution":{"type":"boolean"},"gomAction":{"type":"boolean"},"hidden":{"type":"boolean"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indicatorAction":{"type":"boolean"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"sensitive":{"type":"boolean"},"timeout":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}}
```

## The ConfigField object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ConfigField":{"type":"object","description":"ConfigField holds a configuration field","properties":{"advanced":{"type":"boolean"},"defaultValue":{"type":"string"},"display":{"type":"string"},"displayPassword":{"type":"string"},"hidden":{"type":"boolean"},"hiddenPassword":{"type":"boolean"},"hiddenUsername":{"type":"boolean"},"info":{"type":"string"},"name":{"type":"string"},"options":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"section":{"type":"string"},"type":{"$ref":"#/components/schemas/ConfigDataType"}}},"ConfigDataType":{"type":"number","description":"ConfigDataType holds the type of a configuration field or command argument","format":"double"}}}}
```

## The ConfigDataType object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ConfigDataType":{"type":"number","description":"ConfigDataType holds the type of a configuration field or command argument","format":"double"}}}}
```

## The IntegrationScript object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"IntegrationScript":{"type":"object","title":"IntegrationScript ...","properties":{"commands":{"type":"array","items":{"$ref":"#/components/schemas/Command"}},"dockerImage":{"type":"string"},"feed":{"type":"boolean"},"isFetch":{"type":"boolean"},"isFetchCredentials":{"type":"boolean"},"isFetchEvents":{"type":"boolean"},"isFetchSamples":{"type":"boolean"},"isMappable":{"type":"boolean"},"isRemoteSyncIn":{"type":"boolean"},"isRemoteSyncOut":{"type":"boolean"},"longRunning":{"type":"boolean"},"longRunningPortMapping":{"type":"boolean"},"resetContext":{"type":"boolean"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"type":{"$ref":"#/components/schemas/ScriptType"}}},"Command":{"type":"object","description":"Command supported by a module","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cartesian":{"type":"boolean"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"docsHidden":{"type":"boolean"},"execution":{"type":"boolean"},"gomAction":{"type":"boolean"},"hidden":{"type":"boolean"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indicatorAction":{"type":"boolean"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"sensitive":{"type":"boolean"},"timeout":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}}
```

## The Command object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Command":{"type":"object","description":"Command supported by a module","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cartesian":{"type":"boolean"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"docsHidden":{"type":"boolean"},"execution":{"type":"boolean"},"gomAction":{"type":"boolean"},"hidden":{"type":"boolean"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indicatorAction":{"type":"boolean"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"sensitive":{"type":"boolean"},"timeout":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","description":"Argument to a module command","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}}},"ArgumentType":{"type":"string","title":"ArgumentType ..."},"Important":{"type":"object","description":"Important The important outputs of a given command","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}}},"Output":{"type":"object","description":"Output of a module command","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}}},"OutputType":{"type":"string","title":"OutputType ..."}}}}
```

## The StatsQueryResponse object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"StatsQueryResponse":{"type":"object","title":"StatsQueryResponse - Describe the data returned related to a specific widget cell in a dashboard.","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"data":{"type":"object","description":"data array or object describing the statistics data based on type."},"totalAccounts":{"type":"integer","format":"int64"},"widgetCellId":{"type":"string"}}}}}}
```

## The Unit42IndicatorLookup object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Unit42IndicatorLookup":{"type":"object","description":"Unit42IndicatorLookup - indicator lookup result from Unit42 intel","properties":{"indicator":{"$ref":"#/components/schemas/Unit42Indicator"}}},"Unit42Indicator":{"type":"object","title":"Unit42Indicator ...","additionalProperties":{"type":"object"}}}}}
```

## The Unit42Indicator object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Unit42Indicator":{"type":"object","title":"Unit42Indicator ...","additionalProperties":{"type":"object"}}}}}
```

## The Unit42SampleSearchFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Unit42SampleSearchFilter":{"type":"object","title":"Unit42SampleSearchFilter ...","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"scope":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The Unit42SearchFilter object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Unit42SearchFilter":{"type":"object","title":"Unit42SearchFilter ...","properties":{"Cache":{"type":"object","description":"Cache of join functions","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"Period":{"type":"object","title":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now.","properties":{"by":{"type":"string","description":"By is used for legacty, and if exists it will override ByTo and ByFrom"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}}},"Order":{"type":"object","description":"Order struct holds a sort field and the direction of sorting","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The Info object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"Info":{"type":"object","description":"Info - holds all workers status","properties":{"Available":{"type":"number","format":"double"},"BufferSpace":{"type":"integer","format":"int64"},"Busy":{"type":"integer","format":"int64"},"HighPriorityAvailable":{"type":"number","format":"double"},"HighPriorityBufferSpace":{"type":"integer","format":"int64"},"Name":{"type":"string"},"ProcessInfo":{"type":"array","items":{"$ref":"#/components/schemas/ProcessInfo"}},"ShouldStop":{"type":"boolean"},"Total":{"type":"integer","format":"int64"},"TotalBuffer":{"type":"integer","format":"int64"}}},"ProcessInfo":{"type":"object","description":"ProcessInfo - holds info per worker","properties":{"Details":{"type":"string"},"Duration":{"$ref":"#/components/schemas/Duration"},"HighPriority":{"type":"boolean"},"StartedAt":{"type":"string","format":"date-time"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```

## The ProcessInfo object

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 6 API","version":"6"},"components":{"schemas":{"ProcessInfo":{"type":"object","description":"ProcessInfo - holds info per worker","properties":{"Details":{"type":"string"},"Duration":{"$ref":"#/components/schemas/Duration"},"HighPriority":{"type":"boolean"},"StartedAt":{"type":"string","format":"date-time"}}},"Duration":{"type":"integer","description":"A Duration represents the elapsed time between two instants\nas an int64 nanosecond count. The representation limits the\nlargest representable duration to approximately 290 years.","format":"int64"}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.