> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/entry.md).

# Entry

APIs for managing entries to the War Room

## Create a new incident War Room entry

> Create an entry to an existing incident War Room. Entries are written in Markdown format.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/entry":{"post":{"tags":["Entry"],"summary":"Create a new incident War Room entry","description":"Create an entry to an existing incident War Room. Entries are written in Markdown format.","operationId":"post-xsoar-entry","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntry"}}},"required":false},"responses":{"200":{"description":"OK - Entry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Entry"}}}},"412":{"description":"Precondition failed - Investigation is closed","content":{}}}}}},"components":{"schemas":{"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"Entry":{"type":"object","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","properties":{},"description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","properties":{},"description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined"},"IndicatorTimeline":{"title":"IndicatorTimeline ...","type":"array","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"},"APIExecutionMetric":{"type":"object","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}},"description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","title":""},"EntryCategory":{"title":"EntryCategory ...","type":"string"},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}},"description":"EntryTask holds information regarding the related task"},"FileMetadata":{"title":"FileMetadata ...","type":"object","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"title":"EntryHistory ...","type":"object","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"title":"HumanCron ...","type":"object","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"ModuleArgs represents module args"},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}}
```

## Download an entry file attachment

> Download a file attachment of an incident War Room entry.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/entry/download/{entry_id}":{"get":{"tags":["Entry"],"summary":"Download an entry file attachment","description":"Download a file attachment of an incident War Room entry.","operationId":"get-xsoar-entry-download-entry_id","parameters":[{"name":"entry_id","in":"path","description":"War Room Entry ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object"}},"Example 1":{}}}}}}}}
```

## Mark entry as note or delete entry

> Mark an entry as a note or delete a note.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/entry/note":{"post":{"tags":["Entry"],"summary":"Mark entry as note or delete entry","description":"Mark an entry as a note or delete a note.","operationId":"post-xsoar-entry-note","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntry"}}},"required":false},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Entry"}}}}}}}},"components":{"schemas":{"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"Entry":{"type":"object","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","properties":{},"description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","properties":{},"description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined"},"IndicatorTimeline":{"title":"IndicatorTimeline ...","type":"array","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"},"APIExecutionMetric":{"type":"object","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}},"description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","title":""},"EntryCategory":{"title":"EntryCategory ...","type":"string"},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}},"description":"EntryTask holds information regarding the related task"},"FileMetadata":{"title":"FileMetadata ...","type":"object","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"title":"EntryHistory ...","type":"object","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"title":"HumanCron ...","type":"object","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"ModuleArgs represents module args"},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}}
```

## Set tags on incident War Room entry

> Set one or several tags on an incident War Room entry.

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/entry/tags":{"post":{"tags":["Entry"],"summary":"Set tags on incident War Room entry","operationId":"post-xsoar-entry-tags","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntryTags"}}},"required":false},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Entry"}}}}},"description":"Set one or several tags on an incident War Room entry."}}},"components":{"schemas":{"updateEntryTags":{"type":"object","properties":{"id":{"type":"string"},"investigationId":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}}}},"Entry":{"type":"object","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","properties":{},"description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","properties":{},"description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined"},"IndicatorTimeline":{"title":"IndicatorTimeline ...","type":"array","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"},"APIExecutionMetric":{"type":"object","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}},"description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","title":""},"EntryCategory":{"title":"EntryCategory ...","type":"string"},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}},"description":"EntryTask holds information regarding the related task"},"FileMetadata":{"title":"FileMetadata ...","type":"object","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"title":"EntryHistory ...","type":"object","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"title":"HumanCron ...","type":"object","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"ModuleArgs represents module args"},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}}
```

## POST /xsoar/public/v1/entry/upload/{incident\_id}

> Upload content to an incident War Room entry

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/entry/upload/{incident_id}":{"post":{"summary":"Upload content to an incident War Room entry","tags":["Entry"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"cacheVersn":{"type":"integer"},"category":{"type":"string"},"childs":{"nullable":true},"closed":{"type":"string"},"created":{"type":"string"},"creatingUserId":{"type":"string"},"dbotCreatedBy":{"type":"string"},"details":{"type":"string"},"entries":{"type":"array","items":{"$ref":"#/components/schemas/Entry"}},"entryUsers":{"nullable":true},"highPriority":{"type":"boolean"},"id":{"type":"string"},"invContext":{"nullable":true},"isDebug":{"type":"boolean"},"lastOpen":{"type":"string"},"mirrorAutoClose":{"nullable":true},"mirrorTypes":{"nullable":true},"modified":{"type":"string"},"name":{"type":"string"},"rawCategory":{"type":"string"},"reason":{"nullable":true},"runStatus":{"type":"string"},"sizeInBytes":{"type":"integer"},"slackMirrorAutoClose":{"type":"boolean"},"slackMirrorType":{"type":"string"},"status":{"type":"integer"},"systems":{"nullable":true},"tags":{"nullable":true},"totalEntries":{"type":"integer"},"type":{"type":"integer"},"users":{"type":"array","items":{"type":"string"}},"version":{"type":"integer"}}}}}}},"operationId":"post-xsoar-public-v1-entry-upload","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"requestBody":{"content":{"multipart/form-data":{"schema":{"type":"object","properties":{"file":{"type":"string","format":"binary"},"fileComment":{"type":"string"},"isNoteEntry":{"type":"string"},"showMediaFiles":{"type":"string"},"tags":{"type":"string"}}}}}}}}},"components":{"schemas":{"Entry":{"type":"object","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","properties":{},"description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","properties":{},"description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined"},"IndicatorTimeline":{"title":"IndicatorTimeline ...","type":"array","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"},"APIExecutionMetric":{"type":"object","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}},"description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","title":""},"EntryCategory":{"title":"EntryCategory ...","type":"string"},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}},"description":"EntryTask holds information regarding the related task"},"FileMetadata":{"title":"FileMetadata ...","type":"object","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"title":"EntryHistory ...","type":"object","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"title":"HumanCron ...","type":"object","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"ModuleArgs represents module args"},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}}
```

## Create new entry in existing investigation

> Create a new entry in an existing investigation in markdown format, and get the child entries in response

```json
{"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Entry","description":"APIs for managing entries to the War Room"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/entry/execute/sync":{"post":{"summary":"Create new entry in existing investigation","tags":["Entry"],"responses":{"200":{"description":"OK - Returns an array of the child entries of the executed entry.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Entry"}}}}},"412":{"description":"Precondition Failed - The investigation is already closed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-entry-execute-sync","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Create a new entry in an existing investigation in markdown format, and get the child entries in response","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/updateEntry"}}}}}}},"components":{"schemas":{"Entry":{"type":"object","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","properties":{},"description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","properties":{},"description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created  the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined"},"IndicatorTimeline":{"title":"IndicatorTimeline ...","type":"array","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"},"APIExecutionMetric":{"type":"object","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}},"description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","title":""},"EntryCategory":{"title":"EntryCategory ...","type":"string"},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}},"description":"EntryTask holds information regarding the related task"},"FileMetadata":{"title":"FileMetadata ...","type":"object","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"title":"EntryHistory ...","type":"object","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"title":"HumanCron ...","type":"object","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"ModuleArgs represents module args"},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"},"reply":{"title":"reply","type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}},"description":"The query result upon error."},"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/entry.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.