Scripts
APIs for managing scripts (automations)
Create or update a given automation.
Authorizations
AuthorizationstringRequired
Body
savePasswordbooleanOptional
Responses
200
The saved automation.
application/json
pythonEnabledbooleanOptional
suggestionsstring[]Optional
post/automation
POST /automation HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 2329
{
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"ignoreWorkers": true,
"page": 1,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
]
},
"savePassword": true,
"script": {
"MainEngineInfo": {
"engine": "text",
"engineGroup": "text"
},
"allRead": true,
"allReadWrite": true,
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"cacheVersn": 1,
"comment": "text",
"commitMessage": "text",
"contextKeys": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"definitionId": "text",
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"engine": "text",
"engineGroup": "text",
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"hasRole": true,
"hidden": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"important": [
{
"contextPath": "text",
"description": "text",
"related": "text"
}
],
"indexName": "text",
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"polling": true,
"prevName": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"private": true,
"propagationLabels": [
"text"
],
"pswd": "text",
"rawTags": [
"text"
],
"remote": true,
"roles": [
"text"
],
"runAs": "text",
"runOnce": true,
"script": "text",
"scriptTarget": 1,
"searchableName": "text",
"sensitive": true,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"sourceScripID": "text",
"subtype": "text",
"syncHash": "text",
"system": true,
"tags": [
"text"
],
"timeout": 1,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"type": "text",
"user": "text",
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"visualScript": "text",
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
}200
The saved automation.
{
"pythonEnabled": true,
"scripts": [
{
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"comment": "text",
"contextKeys": [
"text"
],
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"hidden": true,
"id": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"permitted": true,
"polling": true,
"propagationLabels": [
"text"
],
"roles": [
"text"
],
"runAs": "text",
"scriptTarget": 1,
"system": true,
"tags": [
"text"
],
"type": "text",
"user": "text",
"version": 1
}
],
"selectedScript": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"suggestions": [
"text"
]
}Copy given automation
Authorizations
AuthorizationstringRequired
Body
savePasswordbooleanOptional
Responses
200
The saved automation.
application/json
pythonEnabledbooleanOptional
suggestionsstring[]Optional
post/automation/copy
POST /automation/copy HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 2329
{
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"ignoreWorkers": true,
"page": 1,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
]
},
"savePassword": true,
"script": {
"MainEngineInfo": {
"engine": "text",
"engineGroup": "text"
},
"allRead": true,
"allReadWrite": true,
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"cacheVersn": 1,
"comment": "text",
"commitMessage": "text",
"contextKeys": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"definitionId": "text",
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"engine": "text",
"engineGroup": "text",
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"hasRole": true,
"hidden": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"important": [
{
"contextPath": "text",
"description": "text",
"related": "text"
}
],
"indexName": "text",
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"polling": true,
"prevName": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"private": true,
"propagationLabels": [
"text"
],
"pswd": "text",
"rawTags": [
"text"
],
"remote": true,
"roles": [
"text"
],
"runAs": "text",
"runOnce": true,
"script": "text",
"scriptTarget": 1,
"searchableName": "text",
"sensitive": true,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"sourceScripID": "text",
"subtype": "text",
"syncHash": "text",
"system": true,
"tags": [
"text"
],
"timeout": 1,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"type": "text",
"user": "text",
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"visualScript": "text",
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
}200
The saved automation.
{
"pythonEnabled": true,
"scripts": [
{
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"comment": "text",
"contextKeys": [
"text"
],
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"hidden": true,
"id": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"permitted": true,
"polling": true,
"propagationLabels": [
"text"
],
"roles": [
"text"
],
"runAs": "text",
"scriptTarget": 1,
"system": true,
"tags": [
"text"
],
"type": "text",
"user": "text",
"version": 1
}
],
"selectedScript": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"suggestions": [
"text"
]
}Delete a given automation from the system.
Authorizations
AuthorizationstringRequired
Body
savePasswordbooleanOptional
Responses
200
automation deleted
No content
post/automation/delete
POST /automation/delete HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 2329
{
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"ignoreWorkers": true,
"page": 1,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
]
},
"savePassword": true,
"script": {
"MainEngineInfo": {
"engine": "text",
"engineGroup": "text"
},
"allRead": true,
"allReadWrite": true,
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"cacheVersn": 1,
"comment": "text",
"commitMessage": "text",
"contextKeys": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"definitionId": "text",
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"engine": "text",
"engineGroup": "text",
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"hasRole": true,
"hidden": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"important": [
{
"contextPath": "text",
"description": "text",
"related": "text"
}
],
"indexName": "text",
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"polling": true,
"prevName": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"private": true,
"propagationLabels": [
"text"
],
"pswd": "text",
"rawTags": [
"text"
],
"remote": true,
"roles": [
"text"
],
"runAs": "text",
"runOnce": true,
"script": "text",
"scriptTarget": 1,
"searchableName": "text",
"sensitive": true,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"sourceScripID": "text",
"subtype": "text",
"syncHash": "text",
"system": true,
"tags": [
"text"
],
"timeout": 1,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"type": "text",
"user": "text",
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"visualScript": "text",
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
}200
automation deleted
No content
Import an automation to Cortex XSOAR
Authorizations
AuthorizationstringRequired
Body
filestringOptional
file
Responses
200
The saved automation
application/json
AutomationScript represents a script that will run on the system
allReadbooleanOptional
allReadWritebooleanOptional
cacheVersninteger · int64Optional
commentstringOptional
commitMessagestringOptional
contextKeysstring[]Optional
createdstring · date-timeOptional
dbotCreatedBystringOptional
Who has created this event - relevant only for manual incidents
definitionIdstringOptional
deprecatedbooleanOptional
detachedbooleanOptional
dockerImagestringOptional
enabledbooleanOptional
enginestringOptional
Engine that will run the script
engineGroupstringOptional
EngineGroup that will run the script
hasRolebooleanOptional
Internal field to make queries on role faster
hiddenbooleanOptional
idstringOptional
indexNamestringOptional
lockedbooleanOptional
modifiedstring · date-timeOptional
namestringOptional
numericIdinteger · int64Optional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
pollingbooleanOptional
prevNamestringOptional
previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional
Do not change this field manually
primaryTerminteger · int64Optional
privatebooleanOptional
propagationLabelsstring[]Optional
pswdstringOptional
rawTagsstring[]Optional
remotebooleanOptional
rolesstring[]Optional
The role assigned to this investigation
runAsstringOptional
runOncebooleanOptional
scriptstringOptional
scriptTargetinteger · int64Optional
ScriptTarget represents the module where this script should run
searchableNamestringOptional
sensitivebooleanOptional
sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
sourceScripIDstringOptional
subtypestringOptional
ScriptSubType holds the script type version
syncHashstringOptional
systembooleanOptional
tagsstring[]Optional
timeoutinteger · int64Optional
A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.
typestringOptional
ScriptType holds the type of a script
userstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
visualScriptstringOptional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
post/automation/import
POST /automation/import HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: multipart/form-data
Accept: */*
Content-Length: 15
{
"file": "text"
}200
The saved automation
{
"MainEngineInfo": {
"engine": "text",
"engineGroup": "text"
},
"allRead": true,
"allReadWrite": true,
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"cacheVersn": 1,
"comment": "text",
"commitMessage": "text",
"contextKeys": [
"text"
],
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"definitionId": "text",
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"engine": "text",
"engineGroup": "text",
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"hasRole": true,
"hidden": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"important": [
{
"contextPath": "text",
"description": "text",
"related": "text"
}
],
"indexName": "text",
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"polling": true,
"prevName": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"private": true,
"propagationLabels": [
"text"
],
"pswd": "text",
"rawTags": [
"text"
],
"remote": true,
"roles": [
"text"
],
"runAs": "text",
"runOnce": true,
"script": "text",
"scriptTarget": 1,
"searchableName": "text",
"sensitive": true,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"sourceScripID": "text",
"subtype": "text",
"syncHash": "text",
"system": true,
"tags": [
"text"
],
"timeout": 1,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"type": "text",
"user": "text",
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"visualScript": "text",
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Search Automation by filter
Authorizations
AuthorizationstringRequired
Body
automationScriptFilter is a general filter that fetches entities using a query string query using the Query value
ignoreWorkersbooleanOptional
Do not use workers mechanism while searching bleve
pageinteger · int64Optional
0-based page
querystringOptional
searchAfterstring[]Optional
Efficient next page, pass max sort value from previous page
searchAfterElasticstring[]Optional
Efficient next page, pass max ES sort value from previous page
searchBeforestring[]Optional
Efficient prev page, pass min sort value from next page
searchBeforeElasticstring[]Optional
Efficient prev page, pass min ES sort value from next page
sizeinteger · int64Optional
Size is limited to 1000, if not passed it defaults to 0, and no results will return
stripContextbooleanOptional
Responses
200
automationScriptResult
application/json
pythonEnabledbooleanOptional
suggestionsstring[]Optional
post/automation/search
POST /automation/search HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 390
{
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"ignoreWorkers": true,
"page": 1,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"stripContext": true
}200
automationScriptResult
{
"pythonEnabled": true,
"scripts": [
{
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"comment": "text",
"contextKeys": [
"text"
],
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"hidden": true,
"id": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"permitted": true,
"polling": true,
"propagationLabels": [
"text"
],
"roles": [
"text"
],
"runAs": "text",
"scriptTarget": 1,
"system": true,
"tags": [
"text"
],
"type": "text",
"user": "text",
"version": 1
}
],
"selectedScript": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"suggestions": [
"text"
]
}Last updated
Was this helpful?