> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/models.md). # Models ## The AdvanceArg object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"}}}} ``` ## The ArgAtomicFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The ArgFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"}}}} ``` ## The ArgTransformer object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The Argument object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Argument":{"type":"object","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}},"description":"Argument to a module command"},"ArgumentType":{"title":"ArgumentType ...","type":"string"}}}} ``` ## The ArgumentType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ArgumentType":{"title":"ArgumentType ...","type":"string"}}}} ``` ## The ArrayPositions object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ArrayPositions":{"type":"array","items":{"type":"integer","format":"uint64"}}}}} ``` ## The Attachment object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""}}}} ``` ## The AutomationScript object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"AutomationScript":{"type":"object","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"This fields indicates which commands this script depends on"},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"AutomationScript represents a script that will run on the system"},"EngineInfo":{"title":"EngineInfo ...","type":"object","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}},"description":"Argument to a module command"},"ArgumentType":{"title":"ArgumentType ...","type":"string"},"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."},"Important":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}},"description":"Important The important outputs of a given command"},"Output":{"type":"object","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","properties":{},"description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"Output of a module command"},"OutputType":{"title":"OutputType ...","type":"string"},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}} ``` ## The automationScriptFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"automationScriptFilter":{"type":"object","properties":{"Cache":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"Cache of join functions"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map."},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"stripContext":{"type":"boolean"}},"description":"automationScriptFilter is a general filter that fetches entities using a query string query using the Query value"},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"}}}} ``` ## The automationScriptFilterWrapper object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"automationScriptFilterWrapper":{"title":"automationScriptFilterWrapper ...","type":"object","properties":{"savePassword":{"type":"boolean","description":"To have this script password protected, set this to `true` and include the password value in the `pswd` field.\r\nTo leave this script without a password, set this to `false` and leave the value of the `pswd` field empty."},"script":{"$ref":"#/components/schemas/AutomationScript"}}},"AutomationScript":{"type":"object","properties":{"MainEngineInfo":{"$ref":"#/components/schemas/EngineInfo"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"commitMessage":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"definitionId":{"type":"string"},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"This fields indicates which commands this script depends on"},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"important":{"type":"array","items":{"$ref":"#/components/schemas/Important"}},"indexName":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"polling":{"type":"boolean"},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"pswd":{"type":"string"},"rawTags":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runAs":{"type":"string"},"runOnce":{"type":"boolean"},"script":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"searchableName":{"type":"string"},"sensitive":{"type":"boolean"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceScripID":{"type":"string"},"subtype":{"$ref":"#/components/schemas/ScriptSubType"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"timeout":{"$ref":"#/components/schemas/Duration"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"visualScript":{"type":"string"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"AutomationScript represents a script that will run on the system"},"EngineInfo":{"title":"EngineInfo ...","type":"object","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}},"Argument":{"type":"object","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}},"description":"Argument to a module command"},"ArgumentType":{"title":"ArgumentType ...","type":"string"},"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."},"Important":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}},"description":"Important The important outputs of a given command"},"Output":{"type":"object","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","properties":{},"description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"Output of a module command"},"OutputType":{"title":"OutputType ...","type":"string"},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}} ``` ## The automationScriptResult object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"automationScriptResult":{"title":"automationScriptResult ...","type":"object","properties":{"pythonEnabled":{"type":"boolean"},"scripts":{"type":"array","items":{"$ref":"#/components/schemas/ScriptAPI"}},"selectedScript":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"suggestions":{"type":"array","items":{"type":"string"}}}},"ScriptAPI":{"title":"ScriptAPI ...","type":"object","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"comment":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"hidden":{"type":"boolean"},"id":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"roles":{"type":"array","items":{"type":"string"}},"runAs":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}},"description":"Argument to a module command"},"ArgumentType":{"title":"ArgumentType ...","type":"string"},"Output":{"type":"object","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","properties":{},"description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"Output of a module command"},"OutputType":{"title":"OutputType ...","type":"string"},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}} ``` ## The Comment object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."}}}} ``` ## The CommentType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."}}}} ``` ## The Comments object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."}}}} ``` ## The ComplexArg object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"}}}} ``` ## The ContinueOnErrorType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ContinueOnErrorType":{"title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.","type":"string"}}}} ``` ## The CreateIncidentRequest object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"CreateIncidentRequest":{"title":"CreateIncidentRequest","type":"object","required":["name"],"properties":{"closeNotes":{"type":"string","description":"Notes for closing the incident."},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)."},"closed":{"type":"string","description":"Use `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. \r\nUse 'createInvestigation: false","format":"date-time"},"createInvestigation":{"type":"boolean","description":"Use `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. "},"customFields":{"type":"object","additionalProperties":{"type":"object"}},"details":{"type":"string","description":"The details of the incident."},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"modified":{"type":"string","format":"date-time","description":"Date modified."},"name":{"type":"string","description":"Incident name."},"playbookId":{"type":"string","description":"The associated playbook for this incident."},"rawJSON":{"type":"string"},"reason":{"type":"string","description":"The reason an incident was closed."},"severity":{"$ref":"#/components/schemas/Severity"},"sla":{"$ref":"#/components/schemas/SLAState"},"status":{"$ref":"#/components/schemas/IncidentStatus"},"type":{"type":"string","description":"Incident type."}}},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` ## The CustomFields object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."}}}} ``` ## The DBotScore object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."}}}} ``` ## The DataCollectionForm object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"DataCollectionForm":{"title":"DataCollectionForm - a data collection form with questions.","type":"object","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The DateRangeFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"DateRangeFilter":{"title":"DateRangeFilter","type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}},"description":"DateRangeFilter provides common fields for date filtering."},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## The Duration object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## The EndingType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"}}}} ``` ## The EngineInfo object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EngineInfo":{"title":"EngineInfo ...","type":"object","properties":{"engine":{"type":"string","description":"Engine that will run the script"},"engineGroup":{"type":"string","description":"EngineGroup that will run the script"}}}}}} ``` ## The Entry object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Entry":{"type":"object","properties":{"IndicatorTimeline":{"$ref":"#/components/schemas/IndicatorTimeline"},"InstanceID":{"type":"string"},"Relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"apiExecutionMetrics":{"type":"array","items":{"$ref":"#/components/schemas/APIExecutionMetric"}},"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"$ref":"#/components/schemas/EntryCategory"},"contents":{"type":"object","properties":{},"description":"The contents of the entry that is actually indexed - should not be used"},"contentsSize":{"type":"integer","description":"ContentsSize the total size of the contents","format":"int64"},"created":{"type":"string","format":"date-time"},"cron":{"type":"string"},"cronView":{"type":"boolean"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"deleted":{"type":"boolean"},"deletedBy":{"type":"string"},"deletedFromFS":{"type":"boolean"},"endingDate":{"type":"string","format":"date-time"},"endingType":{"$ref":"#/components/schemas/EndingType"},"entryTask":{"$ref":"#/components/schemas/EntryTask"},"errorSource":{"type":"string","description":"Source of the error"},"file":{"type":"string","description":"Filename of associated content"},"fileID":{"type":"string","description":"FileID is the file name when saved in the server"},"fileMetadata":{"$ref":"#/components/schemas/FileMetadata"},"format":{"type":"string","description":"Holds information on how content is formatted"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"history":{"type":"array","description":"Edit history","items":{"$ref":"#/components/schemas/EntryHistory"}},"humanCron":{"$ref":"#/components/schemas/HumanCron"},"id":{"type":"string"},"incidentCreationTime":{"type":"string","description":"store the entry based on IncidentCreationTime","format":"date-time"},"indexName":{"type":"string"},"instance":{"type":"string"},"investigationId":{"type":"string","description":"The id of the investigation it belongs to"},"isTodo":{"type":"boolean","description":"IsTodo"},"mirrored":{"type":"boolean","description":"Only used for outbound mirroring to mark that it is already mirrored to remote system"},"modified":{"type":"string","format":"date-time"},"note":{"type":"boolean","description":"Note"},"numericId":{"type":"integer","format":"int64"},"parentContent":{"type":"object","properties":{},"description":"ParentEntry content - for reference"},"parentEntryTruncated":{"type":"boolean","description":"ParentEntryTruncated - indicates weather entry content was truncated"},"parentId":{"type":"string","description":"ParentId is the ID of the parent entry"},"pinned":{"type":"boolean","description":"Mark entry as pinned = evidence"},"playbookId":{"type":"string","description":"PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook"},"polling":{"type":"boolean","description":"Only used for polling entries"},"pollingArgs":{"$ref":"#/components/schemas/ModuleArgs"},"pollingCommand":{"type":"string"},"pollingItemsRemaining":{"type":"integer","format":"int64"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"readOnly":{"type":"boolean","description":"ReadOnly"},"recurrent":{"type":"boolean"},"reputationSize":{"type":"integer","description":"ReputationSize the total size of the reputation","format":"int64"},"retryTime":{"type":"string","description":"When retry took place","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"scheduled":{"type":"boolean","description":"is it scheduled"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"syncHash":{"type":"string"},"system":{"type":"string","description":"The name of the system associated with this entry"},"tags":{"type":"array","description":"Tags","items":{"type":"string"}},"tagsRaw":{"type":"array","description":"TagsRaw","items":{"type":"string"}},"taskId":{"type":"string","description":"TaskID - used if the entry is assigned as note to a playbook task"},"times":{"type":"integer","format":"int64"},"timesRan":{"type":"integer","format":"int64"},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/EntryType"},"user":{"type":"string","description":"The user who created the entry"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined"},"IndicatorTimeline":{"title":"IndicatorTimeline ...","type":"array","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"},"APIExecutionMetric":{"type":"object","properties":{"apiCallsCount":{"type":"integer","format":"int64"},"type":{"type":"string"}},"description":"APIExecutionMetric is used by an entry to indicate the api details of an execution","title":""},"EntryCategory":{"title":"EntryCategory ...","type":"string"},"EndingType":{"type":"string","description":"EndingType holds the type of schedule Ending"},"EntryTask":{"type":"object","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}},"description":"EntryTask holds information regarding the related task"},"FileMetadata":{"title":"FileMetadata ...","type":"object","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}},"EntryHistory":{"title":"EntryHistory ...","type":"object","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}},"HumanCron":{"title":"HumanCron ...","type":"object","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}},"ModuleArgs":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"ModuleArgs represents module args"},"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}} ``` ## The EntryCategory object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EntryCategory":{"title":"EntryCategory ...","type":"string"}}}} ``` ## The EntryHistory object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EntryHistory":{"title":"EntryHistory ...","type":"object","properties":{"contentDate":{"type":"string","format":"date-time"},"contents":{"type":"string"},"contentsFormat":{"type":"string"},"user":{"type":"string"}}}}}} ``` ## The EntryTask object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EntryTask":{"type":"object","properties":{"playbookName":{"type":"string"},"quiet":{"type":"boolean"},"taskId":{"type":"string"},"taskName":{"type":"string"},"taskStatus":{"type":"string"}},"description":"EntryTask holds information regarding the related task"}}}} ``` ## The EntryType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EntryType":{"type":"number","description":"EntryType specifies the type of the entry","format":"double"}}}} ``` ## The Evidence object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Evidence":{"type":"object","title":"Evidence details.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"description":"Who has created this event - relevant only for manual incidents","type":"string"},"description":{"description":"The description for the resolve","type":"string"},"entryId":{"description":"The entry ID","type":"string"},"fetched":{"description":"when the evidence entry was fetched","type":"string","format":"date-time"},"hasRole":{"description":"Internal field to make queries on role faster","type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentId":{"description":"The incident ID","type":"string"},"indexName":{"type":"string"},"markedBy":{"description":"the user that marked this evidence","type":"string"},"markedDate":{"description":"when this evidence was marked","type":"string","format":"date-time"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"description":"When this evidence has occurred","type":"string","format":"date-time"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"description":"Do not change this field manually","type":"array","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"roles":{"description":"The role assigned to this investigation","type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"description":"Tags","type":"array","items":{"type":"string"}},"tagsRaw":{"description":"TagsRaw","type":"array","items":{"type":"string"}},"taskId":{"description":"when the evidence entry was fetched","type":"string"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}}}}} ``` ## The EvidenceData object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EvidenceData":{"type":"object","properties":{"customFields":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"},"description":"This field must have empty json key"},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"EvidenceData - all evidence properties to evaluate in task process"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The Evidences object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Evidences":{"description":"Evidences is a list of evidence entities","type":"array","items":{"$ref":"#/components/schemas/Evidence"}},"Evidence":{"type":"object","title":"Evidence details.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"description":"Who has created this event - relevant only for manual incidents","type":"string"},"description":{"description":"The description for the resolve","type":"string"},"entryId":{"description":"The entry ID","type":"string"},"fetched":{"description":"when the evidence entry was fetched","type":"string","format":"date-time"},"hasRole":{"description":"Internal field to make queries on role faster","type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentId":{"description":"The incident ID","type":"string"},"indexName":{"type":"string"},"markedBy":{"description":"the user that marked this evidence","type":"string"},"markedDate":{"description":"when this evidence was marked","type":"string","format":"date-time"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"description":"When this evidence has occurred","type":"string","format":"date-time"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"description":"Do not change this field manually","type":"array","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"roles":{"description":"The role assigned to this investigation","type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"description":"Tags","type":"array","items":{"type":"string"}},"tagsRaw":{"description":"TagsRaw","type":"array","items":{"type":"string"}},"taskId":{"description":"when the evidence entry was fetched","type":"string"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}}}}} ``` ## The EvidencesSearchResponse object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"EvidencesSearchResponse":{"description":"EvidencesSearchResponse returns the response from the evidences search","type":"object","properties":{"evidences":{"$ref":"#/components/schemas/Evidences"},"total":{"type":"integer","format":"int64"}}},"Evidences":{"description":"Evidences is a list of evidence entities","type":"array","items":{"$ref":"#/components/schemas/Evidence"}},"Evidence":{"type":"object","title":"Evidence details.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"description":"Who has created this event - relevant only for manual incidents","type":"string"},"description":{"description":"The description for the resolve","type":"string"},"entryId":{"description":"The entry ID","type":"string"},"fetched":{"description":"when the evidence entry was fetched","type":"string","format":"date-time"},"hasRole":{"description":"Internal field to make queries on role faster","type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentId":{"description":"The incident ID","type":"string"},"indexName":{"type":"string"},"markedBy":{"description":"the user that marked this evidence","type":"string"},"markedDate":{"description":"when this evidence was marked","type":"string","format":"date-time"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"description":"When this evidence has occurred","type":"string","format":"date-time"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"description":"Do not change this field manually","type":"array","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"roles":{"description":"The role assigned to this investigation","type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"description":"Tags","type":"array","items":{"type":"string"}},"tagsRaw":{"description":"TagsRaw","type":"array","items":{"type":"string"}},"taskId":{"description":"when the evidence entry was fetched","type":"string"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}}}}} ``` ## The ExpirationPolicy object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"}}}} ``` ## The ExpirationSettingsSource object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"}}}} ``` ## The ExpirationSource object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"}}}} ``` ## The ExpirationStatus object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ExpirationStatus":{"title":"ExpirationStatus","type":"string"}}}} ``` ## The ExtractSettingsMode object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ExtractSettingsMode":{"title":"ExtractSettingsMode","type":"string","description":""}}}} ``` ## The FeedIndicator object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The FeedIndicatorComment object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}}}}} ``` ## The FeedIndicatorsRequest object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FeedIndicatorsRequest":{"description":"FeedIndicatorsRequest is the input for JSON feed indicator ingestion","type":"object","properties":{"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"indicators":{"type":"array","items":{"$ref":"#/components/schemas/RawFeedIndicator"}},"mapperId":{"type":"string"}}},"RawFeedIndicator":{"description":"RawFeedIndicator is an unparsed feed indicator from JSON ingestion","type":"object","additionalProperties":{"type":"object"}}}}} ``` ## The FieldExtractSetting object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FieldExtractSetting":{"title":"FieldExtractSetting","type":"object","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}}}}} ``` ## The FieldMapping object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FieldMapping":{"type":"object","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"FieldMapping - Map a task output (complex or simple value) to an incident field"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The FieldsAlias object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FieldsAlias":{"type":"object","title":"FieldsAlias","properties":{"cliName":{"type":"string"},"type":{"type":"string"}}}}}} ``` ## The FieldGroup object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FieldGroup":{"description":"FieldGroup is the field group","type":"number","format":"double"}}}} ``` ## The FieldMergeStrategy object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FieldMergeStrategy":{"description":"FieldMergeStrategy strategy for merging of indicator fields","type":"string"}}}} ``` ## The FileMetadata object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FileMetadata":{"title":"FileMetadata ...","type":"object","properties":{"info":{"type":"string"},"isMediaFile":{"type":"boolean"},"md5":{"type":"string"},"sha1":{"type":"string"},"sha256":{"type":"string"},"sha512":{"type":"string"},"size":{"type":"integer","format":"int64"},"ssdeep":{"type":"string"},"type":{"type":"string"}}}}}} ``` ## The FilterOperatorID object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"}}}} ``` ## The FormDisplay object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"FormDisplay":{"title":"FormDisplay - display options for communication/ask task (for both email and web forms).","type":"object","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}}}}} ``` ## The genericIndicatorUpdateBatch object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"genericIndicatorUpdateBatch":{"type":"object","properties":{"all":{"type":"boolean","default":false,"description":"Warning: When updating or deleting indicator in a batch, setting this field to `true` will inverse your request and apply the action to all indicators *except* for the ones specified. If there are no indicators that match the filter settings or no indicators specified in the `ids` field, the action will be applied to all indicators. Setting this field to `false` will apply the action only on the indicators specified."},"columns":{"type":"array","items":{"type":"string"}},"doNotWhitelist":{"type":"boolean","description":"To delete a batch of indicators, set this to `true`."},"filter":{"$ref":"#/components/schemas/IndicatorFilter"},"ids":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}}}},"IndicatorFilter":{"title":"IndicatorFilter","type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 100.","format":"int64","default":100},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"DateRangeFilter":{"title":"DateRangeFilter","type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}},"description":"DateRangeFilter provides common fields for date filtering."},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"}}}} ``` ## The GenericStringDateFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"GenericStringDateFilter":{"description":"GenericStringDateFilter is a general filter that will fetch entities using the Query value and a date filter","type":"object","properties":{"Cache":{"description":"Cache of join functions","type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"accounts":{"type":"object","additionalProperties":{"type":"object"}},"fields":{"type":"array","items":{"type":"string"}},"filterobjectquery":{"type":"string"},"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"ignoreWorkers":{"description":"Do not use workers mechanism while searching bleve","type":"boolean"},"page":{"description":"0-based page","type":"integer","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"searchAfter":{"description":"Efficient next page, pass max sort value from previous page","type":"array","items":{"type":"string"}},"searchAfterElastic":{"description":"Efficient next page, pass max ES sort value from previous page","type":"array","items":{"type":"string"}},"searchAfterMap":{"description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.","type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"description":"Efficient prev page, pass min sort value from next page","type":"array","items":{"type":"string"}},"searchBeforeElastic":{"description":"Efficient prev page, pass min ES sort value from next page","type":"array","items":{"type":"string"}},"size":{"description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","type":"integer","format":"int64"},"sort":{"description":"The sort order","type":"array","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"trim_events":{"type":"integer","format":"int64"}}},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## The GenericStringFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"GenericStringFilter":{"type":"object","properties":{"Cache":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"Cache of join functions"},"ignoreWorkers":{"type":"boolean","description":"Do not use workers mechanism while searching bleve"},"page":{"type":"integer","description":"0-based page","format":"int64"},"query":{"type":"string"},"searchAfter":{"type":"array","description":"Efficient next page, pass max sort value from previous page","items":{"type":"string"}},"searchAfterElastic":{"type":"array","description":"Efficient next page, pass max ES sort value from previous page","items":{"type":"string"}},"searchAfterMap":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"Map accounts search after values - stores next page sort values per account.\nThere is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter]\nMore, there is no way to generate correct searchBefore from current page as some tenants may not appear at all.\nThe map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map."},"searchAfterMapOrder":{"type":"object","additionalProperties":{"type":"integer","format":"int64"}},"searchBefore":{"type":"array","description":"Efficient prev page, pass min sort value from next page","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","description":"Efficient prev page, pass min ES sort value from next page","items":{"type":"string"}},"size":{"type":"integer","description":"Size is limited to 1000, if not passed it defaults to 0, and no results will return","format":"int64"},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}}},"description":"GenericStringFilter is a general filter that will fetch entities using the Query value"},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"}}}} ``` ## The GridColumn object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}}}}} ``` ## The Group object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Group":{"type":"object","title":"Group is the response that returns from a statistics query, describing a grouped value.","properties":{"color":{"description":"color used to identify the group","type":"string"},"count":{"description":"The number of participants in the group","type":"integer","format":"int64"},"data":{"description":"The data value provided in array of integer values.","type":"array","items":{"type":"integer","format":"int64"}},"dataType":{"type":"string"},"floatData":{"description":"The data value provided in array of float values.","type":"array","items":{"type":"number","format":"double"}},"groups":{"$ref":"#/components/schemas/Groups"},"name":{"type":"string"},"pivot":{"type":"string"},"query":{"type":"string"},"x":{"type":"number","format":"double"},"y":{"type":"number","format":"double"},"z":{"type":"number","format":"double"}}},"Groups":{"description":"Groups is a list of group entities","type":"array","items":{"$ref":"#/components/schemas/Group"}}}}} ``` ## The Groups object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Groups":{"description":"Groups is a list of group entities","type":"array","items":{"$ref":"#/components/schemas/Group"}},"Group":{"type":"object","title":"Group is the response that returns from a statistics query, describing a grouped value.","properties":{"color":{"description":"color used to identify the group","type":"string"},"count":{"description":"The number of participants in the group","type":"integer","format":"int64"},"data":{"description":"The data value provided in array of integer values.","type":"array","items":{"type":"integer","format":"int64"}},"dataType":{"type":"string"},"floatData":{"description":"The data value provided in array of float values.","type":"array","items":{"type":"number","format":"double"}},"groups":{"$ref":"#/components/schemas/Groups"},"name":{"type":"string"},"pivot":{"type":"string"},"query":{"type":"string"},"x":{"type":"number","format":"double"},"y":{"type":"number","format":"double"},"z":{"type":"number","format":"double"}}}}}} ``` ## The HumanCron object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"HumanCron":{"title":"HumanCron ...","type":"object","properties":{"atTimeHour":{"type":"string"},"atTimeMinute":{"type":"string"},"days":{"type":"array","items":{"type":"string"}},"schedulingType":{"type":"string","description":"the following fields are deprecated. do not use them."},"timePeriod":{"type":"integer","format":"int64"},"timePeriodType":{"type":"string"}}}}}} ``` ## The Important object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Important":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string","description":"Description is either a string or a map from string to interface"},"related":{"type":"string","description":"To what other context path this output is related"}},"description":"Important The important outputs of a given command"}}}} ``` ## The Incident object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Incident":{"title":"Incident","type":"object","properties":{"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","description":"When was this created","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Note: CustomFields (an optional generic object type) is missing from the following definition."},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` ## The IncidentField object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentField":{"type":"object","title":"IncidentField ...","properties":{"aliasTo":{"type":"string"},"aliases":{"type":"array","items":{"$ref":"#/components/schemas/FieldsAlias"}},"associatedToAll":{"type":"boolean"},"associatedTypes":{"description":"AssociatedTypes - list of incident (case) types IDs related to specific incident field","type":"array","items":{"type":"string"}},"autoCompleteTags":{"type":"array","items":{"type":"string"}},"breachScript":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"caseInsensitive":{"type":"boolean"},"cliName":{"type":"string"},"closeForm":{"type":"boolean"},"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"commitMessage":{"type":"string"},"content":{"type":"boolean"},"created":{"type":"string","format":"date-time"},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object"}}},"definitionId":{"type":"string"},"description":{"type":"string"},"editForm":{"type":"boolean"},"fieldCalcScript":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"group":{"$ref":"#/components/schemas/FieldGroup"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isReadOnly":{"type":"boolean"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"mergeStrategy":{"$ref":"#/components/schemas/FieldMergeStrategy"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"neverSetAsRequired":{"type":"boolean"},"numericId":{"type":"integer","format":"int64"},"openEnded":{"type":"boolean"},"orgType":{"type":"string"},"ownerOnly":{"type":"boolean"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"placeholder":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"remote":{"type":"boolean"},"required":{"type":"boolean"},"runScriptAfterUpdate":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"systemAssociatedTypes":{"type":"array","items":{"type":"string"}},"template":{"type":"string"},"threshold":{"type":"number","format":"double"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"type":{"type":"string"},"unmapped":{"type":"boolean"},"unsearchable":{"type":"boolean"},"useAsKpi":{"type":"boolean"},"validatedError":{"type":"string"},"validationRegex":{"type":"string"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"x2_fields":{"type":"string"}}},"FieldsAlias":{"type":"object","title":"FieldsAlias","properties":{"cliName":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."},"FieldGroup":{"description":"FieldGroup is the field group","type":"number","format":"double"},"FieldMergeStrategy":{"description":"FieldMergeStrategy strategy for merging of indicator fields","type":"string"}}}} ``` ## The IncidentFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentFilter":{"title":"IncidentFilter","type":"object","description":"IncidentFilter allows for very simple filtering.","properties":{"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"files":{"type":"array","items":{"type":"string"}},"fromDate":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 25.","format":"int64","default":25},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}}}},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## The IncidentSearchResponseWrapper object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentSearchResponseWrapper":{"description":"IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)","type":"object","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"data":{"description":"in: body","type":"array","items":{"$ref":"#/components/schemas/IncidentWrapper"}},"notUpdated":{"type":"integer","format":"uint64"},"searchAfter":{"type":"array","items":{"type":"string"}},"searchAfterElastic":{"type":"array","items":{"type":"string"}},"searchBefore":{"type":"array","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","items":{"type":"string"}},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IncidentWrapper":{"type":"object","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client"},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` ## The IncidentStatus object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` ## The IncidentType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentType":{"title":"IncidentType","type":"object","properties":{"autorun":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"closureScript":{"type":"string"},"color":{"type":"string"},"commitMessage":{"type":"string"},"days":{"type":"integer","format":"int64"},"daysR":{"type":"integer","format":"int64"},"default":{"type":"boolean"},"definitionId":{"type":"string"},"detached":{"type":"boolean"},"disabled":{"type":"boolean"},"extractSettings":{"$ref":"#/components/schemas/IncidentTypeExtractSettings"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"hours":{"type":"integer","format":"int64"},"hoursR":{"type":"integer","format":"int64"},"id":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"layout":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"onChangeRepAlg":{"$ref":"#/components/schemas/ReputationCalcAlg"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"playbookId":{"type":"string"},"preProcessingScript":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"readonly":{"type":"boolean"},"remote":{"type":"boolean"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sla":{"type":"integer","format":"int64"},"slaReminder":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"},"weeksR":{"type":"integer","format":"int64"}},"description":""},"IncidentTypeExtractSettings":{"title":"IncidentTypeExtractSettings","type":"object","properties":{"fieldCliNameToExtractSettings":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FieldExtractSetting"}},"mode":{"$ref":"#/components/schemas/ExtractSettingsMode"}}},"FieldExtractSetting":{"title":"FieldExtractSetting","type":"object","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}},"ExtractSettingsMode":{"title":"ExtractSettingsMode","type":"string","description":""},"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."}}}} ``` ## The IncidentTypeRequest object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentTypeRequest":{"title":"IncidentTypeRequest","type":"object","properties":{"autorun":{"type":"boolean"},"closureScript":{"type":"string"},"extractSettings":{"$ref":"#/components/schemas/IncidentTypeExtractSettings"},"id":{"type":"string"},"layout":{"type":"string"},"name":{"type":"string"},"playbookId":{"type":"string"},"preProcessingScript":{"type":"string"},"sla":{"type":"integer","format":"int64"},"slaReminder":{"type":"integer","format":"int64"},"color":{"type":"string"}}},"IncidentTypeExtractSettings":{"title":"IncidentTypeExtractSettings","type":"object","properties":{"fieldCliNameToExtractSettings":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FieldExtractSetting"}},"mode":{"$ref":"#/components/schemas/ExtractSettingsMode"}}},"FieldExtractSetting":{"title":"FieldExtractSetting","type":"object","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}},"ExtractSettingsMode":{"title":"ExtractSettingsMode","type":"string","description":""}}}} ``` ## The IncidentTypeExtractSettings object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentTypeExtractSettings":{"title":"IncidentTypeExtractSettings","type":"object","properties":{"fieldCliNameToExtractSettings":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FieldExtractSetting"}},"mode":{"$ref":"#/components/schemas/ExtractSettingsMode"}}},"FieldExtractSetting":{"title":"FieldExtractSetting","type":"object","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}},"ExtractSettingsMode":{"title":"ExtractSettingsMode","type":"string","description":""}}}} ``` ## The IncidentWrapper object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IncidentWrapper":{"type":"object","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client"},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` ## The IndicatorContext object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IndicatorContext":{"type":"object","properties":{"entryId":{"type":"string"},"indicator":{"$ref":"#/components/schemas/IocObject"},"investigationId":{"type":"string"},"manually":{"type":"boolean"},"seenNow":{"type":"boolean"}},"title":""},"IocObject":{"title":"IocObject","type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"IocObject - represents an Ioc (or simply an indicator) object"},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"ExpirationStatus":{"title":"ExpirationStatus","type":"string"},"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."},"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The IndicatorFilter object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IndicatorFilter":{"title":"IndicatorFilter","type":"object","description":"IndicatorFilter is a general filter that fetches entities using a query string query using the Query value","properties":{"filterobjectquery":{"type":"string"},"firstSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"fromDate":{"type":"string","format":"date-time"},"lastSeen":{"$ref":"#/components/schemas/DateRangeFilter"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 100.","format":"int64","default":100},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}}},"DateRangeFilter":{"title":"DateRangeFilter","type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"}},"description":"DateRangeFilter provides common fields for date filtering."},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"}}}} ``` ## The IndicatorResult object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IndicatorResult":{"title":"IndicatorResult","type":"object","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"iocObjects":{"$ref":"#/components/schemas/IocObjects"},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IocObjects":{"title":"IocObjects","type":"array","items":{"$ref":"#/components/schemas/IocObject"}},"IocObject":{"title":"IocObject","type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"IocObject - represents an Ioc (or simply an indicator) object"},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"ExpirationStatus":{"title":"ExpirationStatus","type":"string"},"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."},"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The IndicatorTimeline object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IndicatorTimeline":{"title":"IndicatorTimeline ...","type":"array","items":{"$ref":"#/components/schemas/IndicatorTimelineFromEntry"}},"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}}}}} ``` ## The IndicatorTimelineFromEntry object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IndicatorTimelineFromEntry":{"title":"IndicatorTimelineFromEntry ...","type":"object","properties":{"Category":{"type":"string"},"Message":{"type":"string"},"Source":{"type":"string"},"Time":{"type":"string","format":"date-time"},"User":{"type":"string"},"Value":{"type":"array","items":{"type":"string"}}}}}}} ``` ## The InsightCache object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."}}}} ``` ## The Investigation object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Investigation":{"description":"A special investigation called playground is created for each user-project combination and is a private space for the researcher to play in.","type":"object","title":"Investigation contains the investigation of a particular incident.","properties":{"ShardID":{"type":"integer","format":"int64"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"category":{"description":"Category of the investigation","type":"string"},"childInvestigations":{"description":"ChildInvestigations id's","type":"array","items":{"type":"string"}},"closed":{"description":"When was this closed","type":"string","format":"date-time"},"closingUserId":{"description":"The user ID that closed this investigation","type":"string"},"created":{"type":"string","format":"date-time"},"creatingUserId":{"description":"The user ID that created this investigation","type":"string"},"dbotCreatedBy":{"description":"Who has created this event - relevant only for manual incidents","type":"string"},"details":{"description":"User defined free text details","type":"string"},"entitlements":{"description":"One time entitlements","type":"array","items":{"type":"string"}},"entryUsers":{"description":"EntryUsers","type":"array","items":{"type":"string"}},"hasRole":{"description":"Internal field to make queries on role faster","type":"boolean"},"highPriority":{"description":"HighPriority - tasks of this investigation should run in high priority","type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isChildInvestigation":{"description":"IsChildInvestigation","type":"boolean"},"isDebug":{"description":"IsDebug ...","type":"boolean"},"lastOpen":{"type":"string","format":"date-time"},"mirrorAutoClose":{"description":"MirrorAutoClose will tell us to close the Chat Module channel if we close investigation","type":"object","additionalProperties":{"type":"boolean"}},"mirrorTypes":{"description":"MirrorTypes holds info about mirror direction and message type to be mirrored\nmessage type can be either 'all' or 'chat'\ndirection can be either 'FromDemisto', 'ToDemisto' or 'Both' if this investigation is mirrored","type":"object","additionalProperties":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"description":"The name of the investigation, which is unique to the project","type":"string"},"numericId":{"type":"integer","format":"int64"},"openDuration":{"description":"Duration from open to close time","type":"integer","format":"int64"},"parentInvestigation":{"description":"ParentInvestigation - parent id, in case this is a child investigation of another investigation","type":"string"},"persistentEntitlements":{"description":"Persistent entitlement per tag. Empty tag will also return an entitlement","type":"object","additionalProperties":{"type":"string"}},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"description":"Do not change this field manually","type":"array","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"reason":{"description":"The reason for the status (resolve)","type":"object","additionalProperties":{"type":"string"}},"roles":{"description":"The role assigned to this investigation","type":"array","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"slackMirrorAutoClose":{"description":"DEPRECATED - DeprecatedSlackMirrorAutoClose will tell us to close the Slack channel if we close investigation","type":"boolean"},"slackMirrorType":{"description":"DEPRECATED - DeprecatedSlackMirrorType holds info about mirror direction and message type to be mirror\nmessage type can be either 'all' or 'chat'\ndirection can be either 'demisto2Slack', 'slack2Demisto' or 'both' if this investigation is mirrored to Slack","type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"status":{"$ref":"#/components/schemas/InvestigationStatus"},"syncHash":{"type":"string"},"systems":{"description":"The systems involved","type":"array","items":{"$ref":"#/components/schemas/System"}},"tags":{"description":"Tags","type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/InvestigationType"},"users":{"description":"The users who share this investigation","type":"array","items":{"type":"string"}},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"InvestigationStatus":{"description":"InvestigationStatus is the status type","type":"number","format":"double"},"System":{"description":"System - URL stands for ip or hostname","type":"object","properties":{"agent":{"$ref":"#/components/schemas/SystemAgent"},"arch":{"type":"string"},"ciphers":{"type":"array","items":{"type":"string"}},"credentials":{"type":"string"},"engineId":{"type":"string"},"host":{"type":"string"},"integrationinstanceid":{"type":"string"},"issharedagent":{"type":"boolean"},"name":{"type":"string"},"os":{"type":"string"},"password":{"type":"string"},"servicesID":{"type":"string"},"smb":{"type":"integer","format":"int64"},"smbport":{"type":"integer","format":"uint16"},"sshkey":{"type":"string"},"sshport":{"type":"integer","format":"uint16"},"terminalOptions":{"$ref":"#/components/schemas/TerminalOptions"},"user":{"type":"string"},"workgroup":{"type":"string"}}},"SystemAgent":{"description":"SystemAgent - represents agent status and holds server context","type":"object","properties":{"servercontext":{"type":"array","items":{"type":"integer","format":"uint8"}}}},"TerminalOptions":{"description":"TerminalOptions - terminal options to use in case of using pty","type":"object","properties":{"Echo":{"type":"integer","format":"uint32"},"Terminal":{"type":"boolean"},"TerminalHeight":{"type":"integer","format":"int64"},"TerminalType":{"type":"string"},"TerminalWidth":{"type":"integer","format":"int64"},"TyISpeed":{"type":"integer","format":"uint32"},"TyOSpeed":{"type":"integer","format":"uint32"}}},"InvestigationType":{"type":"number","format":"double","title":"InvestigationType ..."}}}} ``` ## The InvestigationPlaybook object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvestigationPlaybook":{"type":"object","properties":{"Dirty":{"type":"boolean"},"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"ReplacedPlaybook":{"type":"boolean","description":"Indicate whether this playbook has new history during this session"},"ShardID":{"type":"integer","format":"int64"},"UpdatedOperatorIDs":{"type":"boolean"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"autoExtracting":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentCreateDate":{"type":"string","description":"Incident create date","format":"date-time"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"invPBDebugInfo":{"$ref":"#/components/schemas/InvPlaybookDebugInfo"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pbHistory":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/InvestigationPlaybookData"}},"pendingTasks":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"Tasks that are marked for running, but cannot yet run due to incomplete parents"},"playbookId":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"quiet":{"type":"boolean"},"recoveryAttempts":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"serverId":{"type":"string","description":"Holds the ID of the responsible cluster app server"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"syncHash":{"type":"string"},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"InvestigationPlaybook is a wrapper for a linked list of Playbook tasks"},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"PlaybookInput represents the playbook input"},"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"InvPlaybookDebugInfo":{"title":"InvPlaybookDebugInfo ...","type":"object","properties":{"originalInvPBId":{"type":"string"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"PlaybookOutput represents the playbook output"},"OutputType":{"title":"OutputType ...","type":"string"},"InvestigationPlaybookData":{"type":"object","properties":{"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"autoExtracting":{"type":"boolean"},"comment":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"name":{"type":"string"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pendingTasks":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"Tasks that are marked for running, but cannot yet run due to incomplete parents"},"playbookId":{"type":"string"},"quiet":{"type":"boolean"},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"view":{"$ref":"#/components/schemas/PlaybookView"}},"description":"InvestigationPlaybookData returns all data of an investigation playbook, not including history"},"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"},"InvestigationPlaybookTask":{"type":"object","properties":{"Reopen":{"type":"boolean"},"arguments":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"assignee":{"type":"string"},"assigneeSet":{"type":"boolean"},"blockingTasks":{"type":"array","items":{"type":"string"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"comments":{"type":"boolean","description":"Whether this task had any comments or not"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"doNotSaveTaskHistory":{"type":"boolean"},"dueDate":{"type":"string","format":"date-time"},"dueDateDuration":{"type":"integer","format":"int64"},"dueDateDurationUnit":{"$ref":"#/components/schemas/SLADurationUnit"},"dueDateSet":{"type":"boolean"},"entries":{"type":"array","items":{"type":"string"}},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"executionCount":{"type":"integer","format":"int64"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"forEachIndex":{"type":"integer","description":"Parameters needed for loops","format":"int64"},"forEachInputs":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object","properties":{}}}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"hasErrorEntries":{"type":"boolean"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"indent":{"type":"integer","format":"int64"},"input":{"type":"string"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"missingContentItem":{"type":"string","description":"content item which caused task to skip"},"nextPollingTime":{"type":"string","description":"NextPollTime Time of the next scheduled command execution","format":"date-time"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"outputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"parentBlockCount":{"type":"integer","description":"the number of tasks that are waiting on blocked in subplaybooks of this task","format":"int64"},"parentPlaybookID":{"type":"string"},"patched":{"type":"boolean","description":"Indicates whether this task was patched to InvPB and did not originally belong to the playbook"},"playbookInputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"pollingEntries":{"type":"array","description":"PollingEntryIDs IDs of entries that are still polling","items":{"type":"string"}},"pollingTimeoutTime":{"type":"string","format":"date-time"},"previousTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reminder":{"type":"integer","description":"Duration in minutes, this field is not persisted here","format":"int64"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skip":{"type":"boolean","description":"Skip - if true then this task will be skipped and all the tasks which comes after this task and depend on it\nwill skip (WillNotExecute)"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"startDate":{"type":"string","format":"date-time"},"startedExecutingHarmfulScript":{"type":"boolean"},"state":{"$ref":"#/components/schemas/TaskState"},"subPlaybook":{"$ref":"#/components/schemas/InvestigationPlaybook"},"task":{"$ref":"#/components/schemas/Task"},"taskCompleteData":{"type":"array","description":"History complete data","items":{"$ref":"#/components/schemas/InvPlaybookTaskCompleteData"}},"taskDebug":{"$ref":"#/components/schemas/InvTaskDebug"},"taskId":{"type":"string"},"taskSize":{"type":"integer","format":"int64"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"timesPolled":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}},"description":"InvestigationPlaybookTask is the Task in the playbook context as a node"},"TaskCondition":{"type":"object","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}},"description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)"},"ContinueOnErrorType":{"title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.","type":"string"},"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"},"EvidenceData":{"type":"object","properties":{"customFields":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"},"description":"This field must have empty json key"},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"EvidenceData - all evidence properties to evaluate in task process"},"FieldMapping":{"type":"object","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"FieldMapping - Map a task output (complex or simple value) to an incident field"},"DataCollectionForm":{"title":"DataCollectionForm - a data collection form with questions.","type":"object","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"title":"FormDisplay - display options for communication/ask task (for both email and web forms).","type":"object","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"NotifiableItem":{"title":"NotifiableItem ...","type":"object","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."},"SLA":{"title":"SLA ...","type":"object","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"},"Task":{"type":"object","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}},"description":"Task is the basic task in the task repository that can be associated to an incident via playbook"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"InvPlaybookTaskCompleteData":{"title":"InvPlaybookTaskCompleteData ...","type":"object","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"InvTaskDebug":{"title":"InvTaskDebug ...","type":"object","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"TimerTrigger":{"title":"TimerTrigger ...","type":"object","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"title":"TimerAction ...","type":"string"},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}} ``` ## The InvestigationPlaybookData object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvestigationPlaybookData":{"type":"object","properties":{"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"autoExtracting":{"type":"boolean"},"comment":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"name":{"type":"string"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pendingTasks":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"Tasks that are marked for running, but cannot yet run due to incomplete parents"},"playbookId":{"type":"string"},"quiet":{"type":"boolean"},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"view":{"$ref":"#/components/schemas/PlaybookView"}},"description":"InvestigationPlaybookData returns all data of an investigation playbook, not including history"},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"PlaybookInput represents the playbook input"},"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"PlaybookOutput represents the playbook output"},"OutputType":{"title":"OutputType ...","type":"string"},"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"},"InvestigationPlaybookTask":{"type":"object","properties":{"Reopen":{"type":"boolean"},"arguments":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"assignee":{"type":"string"},"assigneeSet":{"type":"boolean"},"blockingTasks":{"type":"array","items":{"type":"string"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"comments":{"type":"boolean","description":"Whether this task had any comments or not"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"doNotSaveTaskHistory":{"type":"boolean"},"dueDate":{"type":"string","format":"date-time"},"dueDateDuration":{"type":"integer","format":"int64"},"dueDateDurationUnit":{"$ref":"#/components/schemas/SLADurationUnit"},"dueDateSet":{"type":"boolean"},"entries":{"type":"array","items":{"type":"string"}},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"executionCount":{"type":"integer","format":"int64"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"forEachIndex":{"type":"integer","description":"Parameters needed for loops","format":"int64"},"forEachInputs":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object","properties":{}}}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"hasErrorEntries":{"type":"boolean"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"indent":{"type":"integer","format":"int64"},"input":{"type":"string"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"missingContentItem":{"type":"string","description":"content item which caused task to skip"},"nextPollingTime":{"type":"string","description":"NextPollTime Time of the next scheduled command execution","format":"date-time"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"outputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"parentBlockCount":{"type":"integer","description":"the number of tasks that are waiting on blocked in subplaybooks of this task","format":"int64"},"parentPlaybookID":{"type":"string"},"patched":{"type":"boolean","description":"Indicates whether this task was patched to InvPB and did not originally belong to the playbook"},"playbookInputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"pollingEntries":{"type":"array","description":"PollingEntryIDs IDs of entries that are still polling","items":{"type":"string"}},"pollingTimeoutTime":{"type":"string","format":"date-time"},"previousTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reminder":{"type":"integer","description":"Duration in minutes, this field is not persisted here","format":"int64"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skip":{"type":"boolean","description":"Skip - if true then this task will be skipped and all the tasks which comes after this task and depend on it\nwill skip (WillNotExecute)"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"startDate":{"type":"string","format":"date-time"},"startedExecutingHarmfulScript":{"type":"boolean"},"state":{"$ref":"#/components/schemas/TaskState"},"subPlaybook":{"$ref":"#/components/schemas/InvestigationPlaybook"},"task":{"$ref":"#/components/schemas/Task"},"taskCompleteData":{"type":"array","description":"History complete data","items":{"$ref":"#/components/schemas/InvPlaybookTaskCompleteData"}},"taskDebug":{"$ref":"#/components/schemas/InvTaskDebug"},"taskId":{"type":"string"},"taskSize":{"type":"integer","format":"int64"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"timesPolled":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}},"description":"InvestigationPlaybookTask is the Task in the playbook context as a node"},"TaskCondition":{"type":"object","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}},"description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)"},"ContinueOnErrorType":{"title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.","type":"string"},"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"},"EvidenceData":{"type":"object","properties":{"customFields":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"},"description":"This field must have empty json key"},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"EvidenceData - all evidence properties to evaluate in task process"},"FieldMapping":{"type":"object","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"FieldMapping - Map a task output (complex or simple value) to an incident field"},"DataCollectionForm":{"title":"DataCollectionForm - a data collection form with questions.","type":"object","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"title":"FormDisplay - display options for communication/ask task (for both email and web forms).","type":"object","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"NotifiableItem":{"title":"NotifiableItem ...","type":"object","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."},"SLA":{"title":"SLA ...","type":"object","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"},"InvestigationPlaybook":{"type":"object","properties":{"Dirty":{"type":"boolean"},"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"ReplacedPlaybook":{"type":"boolean","description":"Indicate whether this playbook has new history during this session"},"ShardID":{"type":"integer","format":"int64"},"UpdatedOperatorIDs":{"type":"boolean"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"autoExtracting":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentCreateDate":{"type":"string","description":"Incident create date","format":"date-time"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"invPBDebugInfo":{"$ref":"#/components/schemas/InvPlaybookDebugInfo"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pbHistory":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/InvestigationPlaybookData"}},"pendingTasks":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"Tasks that are marked for running, but cannot yet run due to incomplete parents"},"playbookId":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"quiet":{"type":"boolean"},"recoveryAttempts":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"serverId":{"type":"string","description":"Holds the ID of the responsible cluster app server"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"syncHash":{"type":"string"},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"InvestigationPlaybook is a wrapper for a linked list of Playbook tasks"},"InvPlaybookDebugInfo":{"title":"InvPlaybookDebugInfo ...","type":"object","properties":{"originalInvPBId":{"type":"string"}}},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"},"Task":{"type":"object","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}},"description":"Task is the basic task in the task repository that can be associated to an incident via playbook"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"InvPlaybookTaskCompleteData":{"title":"InvPlaybookTaskCompleteData ...","type":"object","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"InvTaskDebug":{"title":"InvTaskDebug ...","type":"object","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"TimerTrigger":{"title":"TimerTrigger ...","type":"object","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"title":"TimerAction ...","type":"string"},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}} ``` ## The InvestigationPlaybookState object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"}}}} ``` ## The InvestigationPlaybookTask object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvestigationPlaybookTask":{"type":"object","properties":{"Reopen":{"type":"boolean"},"arguments":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"assignee":{"type":"string"},"assigneeSet":{"type":"boolean"},"blockingTasks":{"type":"array","items":{"type":"string"}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"comments":{"type":"boolean","description":"Whether this task had any comments or not"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"conditions":{"type":"array","description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"doNotSaveTaskHistory":{"type":"boolean"},"dueDate":{"type":"string","format":"date-time"},"dueDateDuration":{"type":"integer","format":"int64"},"dueDateDurationUnit":{"$ref":"#/components/schemas/SLADurationUnit"},"dueDateSet":{"type":"boolean"},"entries":{"type":"array","items":{"type":"string"}},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"executionCount":{"type":"integer","format":"int64"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"forEachIndex":{"type":"integer","description":"Parameters needed for loops","format":"int64"},"forEachInputs":{"type":"object","additionalProperties":{"type":"array","items":{"type":"object","properties":{}}}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"hasErrorEntries":{"type":"boolean"},"id":{"type":"string"},"ignoreWorker":{"type":"boolean","description":"Do not run this task in a worker"},"indent":{"type":"integer","format":"int64"},"input":{"type":"string"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"missingContentItem":{"type":"string","description":"content item which caused task to skip"},"nextPollingTime":{"type":"string","description":"NextPollTime Time of the next scheduled command execution","format":"date-time"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"outputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"parentBlockCount":{"type":"integer","description":"the number of tasks that are waiting on blocked in subplaybooks of this task","format":"int64"},"parentPlaybookID":{"type":"string"},"patched":{"type":"boolean","description":"Indicates whether this task was patched to InvPB and did not originally belong to the playbook"},"playbookInputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"pollingEntries":{"type":"array","description":"PollingEntryIDs IDs of entries that are still polling","items":{"type":"string"}},"pollingTimeoutTime":{"type":"string","format":"date-time"},"previousTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reminder":{"type":"integer","description":"Duration in minutes, this field is not persisted here","format":"int64"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skip":{"type":"boolean","description":"Skip - if true then this task will be skipped and all the tasks which comes after this task and depend on it\nwill skip (WillNotExecute)"},"skipUnavailable":{"type":"boolean","description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"startDate":{"type":"string","format":"date-time"},"startedExecutingHarmfulScript":{"type":"boolean"},"state":{"$ref":"#/components/schemas/TaskState"},"subPlaybook":{"$ref":"#/components/schemas/InvestigationPlaybook"},"task":{"$ref":"#/components/schemas/Task"},"taskCompleteData":{"type":"array","description":"History complete data","items":{"$ref":"#/components/schemas/InvPlaybookTaskCompleteData"}},"taskDebug":{"$ref":"#/components/schemas/InvTaskDebug"},"taskId":{"type":"string"},"taskSize":{"type":"integer","format":"int64"},"timerTriggers":{"type":"array","description":"SLA fields","items":{"$ref":"#/components/schemas/TimerTrigger"}},"timesPolled":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}},"description":"InvestigationPlaybookTask is the Task in the playbook context as a node"},"TaskCondition":{"type":"object","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}},"description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)"},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ContinueOnErrorType":{"title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.","type":"string"},"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"},"EvidenceData":{"type":"object","properties":{"customFields":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"},"description":"This field must have empty json key"},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"EvidenceData - all evidence properties to evaluate in task process"},"FieldMapping":{"type":"object","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"FieldMapping - Map a task output (complex or simple value) to an incident field"},"DataCollectionForm":{"title":"DataCollectionForm - a data collection form with questions.","type":"object","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"title":"FormDisplay - display options for communication/ask task (for both email and web forms).","type":"object","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"NotifiableItem":{"title":"NotifiableItem ...","type":"object","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."},"SLA":{"title":"SLA ...","type":"object","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"},"InvestigationPlaybook":{"type":"object","properties":{"Dirty":{"type":"boolean"},"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"ReplacedPlaybook":{"type":"boolean","description":"Indicate whether this playbook has new history during this session"},"ShardID":{"type":"integer","format":"int64"},"UpdatedOperatorIDs":{"type":"boolean"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"autoExtracting":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"comment":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"incidentCreateDate":{"type":"string","description":"Incident create date","format":"date-time"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"invPBDebugInfo":{"$ref":"#/components/schemas/InvPlaybookDebugInfo"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pbHistory":{"type":"array","description":"in: body","items":{"$ref":"#/components/schemas/InvestigationPlaybookData"}},"pendingTasks":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"Tasks that are marked for running, but cannot yet run due to incomplete parents"},"playbookId":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"quiet":{"type":"boolean"},"recoveryAttempts":{"type":"integer","format":"int64"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"serverId":{"type":"string","description":"Holds the ID of the responsible cluster app server"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"syncHash":{"type":"string"},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"InvestigationPlaybook is a wrapper for a linked list of Playbook tasks"},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"PlaybookInput represents the playbook input"},"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"},"InvPlaybookDebugInfo":{"title":"InvPlaybookDebugInfo ...","type":"object","properties":{"originalInvPBId":{"type":"string"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"PlaybookOutput represents the playbook output"},"OutputType":{"title":"OutputType ...","type":"string"},"InvestigationPlaybookData":{"type":"object","properties":{"ReadyPlaybookInputs":{"type":"object","additionalProperties":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"autoExtracting":{"type":"boolean"},"comment":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"investigationId":{"type":"string"},"isTIM":{"type":"boolean"},"name":{"type":"string"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"pendingTasks":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"Tasks that are marked for running, but cannot yet run due to incomplete parents"},"playbookId":{"type":"string"},"quiet":{"type":"boolean"},"startDate":{"type":"string","format":"date-time"},"startTaskId":{"type":"string","description":"FirstTask is the root task of the playbook"},"state":{"$ref":"#/components/schemas/InvestigationPlaybookState"},"subPlaybookInputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookInputs"}},"subPlaybookOutputs":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookOutputs"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/InvestigationPlaybookTask"}},"view":{"$ref":"#/components/schemas/PlaybookView"}},"description":"InvestigationPlaybookData returns all data of an investigation playbook, not including history"},"InvestigationPlaybookState":{"type":"string","description":"InvestigationPlaybookState indicates the state of the running playbook"},"Task":{"type":"object","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}},"description":"Task is the basic task in the task repository that can be associated to an incident via playbook"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"InvPlaybookTaskCompleteData":{"title":"InvPlaybookTaskCompleteData ...","type":"object","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"InvTaskDebug":{"title":"InvTaskDebug ...","type":"object","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"TimerTrigger":{"title":"TimerTrigger ...","type":"object","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"title":"TimerAction ...","type":"string"},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}} ``` ## The InvestigationStatus object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvestigationStatus":{"description":"InvestigationStatus is the status type","type":"number","format":"double"}}}} ``` ## The InvestigationType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvestigationType":{"type":"number","format":"double","title":"InvestigationType ..."}}}} ``` ## The InvPlaybookDebugInfo object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvPlaybookDebugInfo":{"title":"InvPlaybookDebugInfo ...","type":"object","properties":{"originalInvPBId":{"type":"string"}}}}}} ``` ## The InvPlaybookTaskCompleteData object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvPlaybookTaskCompleteData":{"title":"InvPlaybookTaskCompleteData ...","type":"object","properties":{"arguments":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"calculatedDescription":{"type":"string"},"calculatedTaskName":{"type":"string"},"completedBy":{"type":"string"},"completedCount":{"type":"integer","format":"int64"},"completedDate":{"type":"string","format":"date-time"},"entries":{"type":"array","items":{"type":"string"}},"hasErrorEntries":{"type":"boolean"},"input":{"type":"string"},"outputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"playbookInputs":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"startDate":{"type":"string","format":"date-time"},"state":{"$ref":"#/components/schemas/TaskState"},"willNotExecuteCount":{"type":"integer","format":"int64"},"willNotExecuteReason":{"type":"string"}}},"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"}}}} ``` ## The InvPlaybookTaskData object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvPlaybookTaskData":{"type":"object","title":"InvPlaybookTaskData ...","properties":{"addAfter":{"type":"boolean"},"addToSeparateBranch":{"type":"boolean"},"automationScript":{"type":"string"},"description":{"type":"string"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"name":{"type":"string"},"neighborInvPBTaskId":{"type":"string"},"playbookId":{"type":"string"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"}}},"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"}}}} ``` ## The InvTaskDebug object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"InvTaskDebug":{"title":"InvTaskDebug ...","type":"object","properties":{"breakpointCondition":{"$ref":"#/components/schemas/ArgFilter"},"inputOverrides":{"type":"object","additionalProperties":{"type":"string"}},"isMarkedWithBreakpoint":{"type":"boolean"},"isMarkedWithSkip":{"type":"boolean"},"outputOverrides":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"shouldOverrideDebugInfo":{"type":"boolean"},"skipConditionOverrideTo":{"type":"string"},"taskOriginalId":{"type":"string"}}},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"}}}} ``` ## The invTaskInfo object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"invTaskInfo":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"comment":{"type":"string"},"inTaskID":{"type":"string"},"input":{"type":"string"},"invId":{"type":"string"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The IocObject object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IocObject":{"title":"IocObject","type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"IocObject - represents an Ioc (or simply an indicator) object"},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"ExpirationStatus":{"title":"ExpirationStatus","type":"string"},"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."},"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The IocObjects object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"IocObjects":{"title":"IocObjects","type":"array","items":{"$ref":"#/components/schemas/IocObject"}},"IocObject":{"title":"IocObject","type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"aggregatedReliability":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"calculatedTime":{"type":"string","description":"Do not set the fields bellow this line","format":"date-time"},"comment":{"type":"string"},"comments":{"$ref":"#/components/schemas/Comments"},"deletedFeedFetchTime":{"type":"string","format":"date-time"},"expiration":{"type":"string","format":"date-time"},"expirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"expirationStatus":{"$ref":"#/components/schemas/ExpirationStatus"},"firstSeen":{"type":"string","format":"date-time"},"firstSeenEntryID":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indicator_type":{"type":"string"},"insightCache":{"$ref":"#/components/schemas/InsightCache"},"investigationIDs":{"type":"array","items":{"type":"string"}},"isDetectable":{"type":"boolean"},"isPreventable":{"type":"boolean"},"isShared":{"type":"boolean"},"lastReputationRun":{"type":"string","format":"date-time"},"lastSeen":{"type":"string","format":"date-time"},"lastSeenEntryID":{"type":"string"},"manualExpirationTime":{"type":"string","format":"date-time"},"manualScore":{"type":"boolean"},"manualSetTime":{"type":"string","format":"date-time"},"manuallyEditedFields":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"modifiedTime":{"type":"string","format":"date-time"},"moduleToFeedMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FeedIndicator"}},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"relatedIncCount":{"type":"integer","format":"int64"},"score":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"setBy":{"type":"string"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"sourceBrands":{"type":"array","items":{"type":"string"}},"sourceInstances":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"value":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"IocObject - represents an Ioc (or simply an indicator) object"},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Comments":{"title":"Comments","type":"array","items":{"$ref":"#/components/schemas/Comment"}},"Comment":{"title":"Comment","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"category":{"type":"string"},"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"entryId":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"source":{"type":"string"},"syncHash":{"type":"string"},"type":{"$ref":"#/components/schemas/CommentType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"CommentType":{"title":"CommentType","type":"string","description":"Comment types: regular comment, timeline, etc..."},"ExpirationSource":{"title":"ExpirationSource","type":"object","properties":{"brand":{"type":"string"},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"instance":{"type":"string"},"moduleId":{"type":"string"},"setTime":{"type":"string","format":"date-time"},"source":{"$ref":"#/components/schemas/ExpirationSettingsSource"},"user":{"type":"string"}}},"ExpirationPolicy":{"title":"ExpirationPolicy","type":"string"},"ExpirationSettingsSource":{"title":"ExpirationSettingsSource","type":"string"},"ExpirationStatus":{"title":"ExpirationStatus","type":"string"},"InsightCache":{"title":"InsightCache","type":"object","properties":{"cacheVersn":{"type":"integer","format":"int64"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"modified":{"type":"string","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"primaryTerm":{"type":"integer","format":"int64"},"scores":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DBotScore"}},"sequenceNumber":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"version":{"type":"integer","format":"int64"}},"description":"InsightCache - map insight name to all its metadata. Name is case insensitive."},"DBotScore":{"title":"DBotScore","type":"object","properties":{"content":{"type":"string"},"contentFormat":{"type":"string"},"context":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"isTypedIndicator":{"type":"boolean"},"reliability":{"type":"string"},"score":{"type":"integer","format":"int64"},"scoreChangeTimestamp":{"type":"string","description":"We need to track when the score changes to know if we need to re-calculate the overall score","format":"date-time"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":"Contains the score of a specific brand for a specific insight."},"FeedIndicator":{"title":"FeedIndicator","type":"object","properties":{"ExpirationSource":{"$ref":"#/components/schemas/ExpirationSource"},"bypassExclusionList":{"type":"boolean"},"classifierId":{"type":"string"},"classifierVersion":{"type":"integer","format":"int64"},"comments":{"type":"array","items":{"$ref":"#/components/schemas/FeedIndicatorComment"}},"expirationInterval":{"type":"integer","format":"int64"},"expirationPolicy":{"$ref":"#/components/schemas/ExpirationPolicy"},"fetchTime":{"type":"string","format":"date-time"},"fields":{"$ref":"#/components/schemas/CustomFields"},"isEnrichment":{"type":"boolean"},"mapperId":{"type":"string"},"mapperVersion":{"type":"integer","format":"int64"},"modifiedTime":{"type":"string","format":"date-time"},"moduleId":{"type":"string"},"rawJSON":{"type":"object","additionalProperties":{"type":"object","properties":{}}},"relationships":{"$ref":"#/components/schemas/RelationshipsAPI"},"reliability":{"$ref":"#/components/schemas/Reliability"},"score":{"type":"integer","format":"int64"},"sourceBrand":{"type":"string"},"sourceInstance":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"type":{"type":"string"},"value":{"type":"string"}},"description":""},"FeedIndicatorComment":{"title":"FeedIndicatorComment","type":"object","properties":{"content":{"type":"string"},"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"user":{"type":"string"}}},"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The KeyValueArg object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"}}}} ``` ## The Label object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}}}}} ``` ## The ModuleArgs object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ModuleArgs":{"type":"object","additionalProperties":{"type":"object","properties":{}},"description":"ModuleArgs represents module args"}}}} ``` ## The NotifiableItem object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"NotifiableItem":{"title":"NotifiableItem ...","type":"object","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}}}}} ``` ## The NotifyTimings object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}}}}} ``` ## The OperatorArgument object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The Order object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"}}}} ``` ## The Output object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Output":{"type":"object","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","properties":{},"description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"Output of a module command"},"OutputType":{"title":"OutputType ...","type":"string"}}}} ``` ## The OutputType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"OutputType":{"title":"OutputType ...","type":"string"}}}} ``` ## The Period object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."}}}} ``` ## The Playbook object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Playbook":{"description":"Playbook is a collection of tasks","type":"object","properties":{"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"brands":{"type":"array","items":{"type":"string"}},"cacheVersn":{"type":"integer","format":"int64"},"commands":{"type":"array","items":{"type":"string"}},"comment":{"type":"string"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"description":"Who has created this event - relevant only for manual incidents","type":"string"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"encTasks":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"description":"Internal field to make queries on role faster","type":"boolean"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"missingScriptsIds":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"nameRaw":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"description":"Do not change this field manually","type":"array","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"quiet":{"type":"boolean"},"remote":{"type":"boolean"},"roles":{"description":"The role assigned to this investigation","type":"array","items":{"type":"string"}},"scriptIds":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourcePlaybookID":{"type":"string"},"startTaskId":{"type":"string"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"taskIds":{"description":"auto generated field that will contain all task ids in this playbook\nNeeded for searching with bleve","type":"array","items":{"type":"string"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookTask"}},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"PlaybookInput represents the playbook input"},"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"PlaybookOutput represents the playbook output"},"OutputType":{"title":"OutputType ...","type":"string"},"PlaybookTask":{"type":"object","title":"PlaybookTask ...","properties":{"conditions":{"description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","type":"array","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"id":{"type":"string"},"ignoreWorker":{"description":"Do not run this task in a worker","type":"boolean"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skipUnavailable":{"description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto","type":"boolean"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"task":{"$ref":"#/components/schemas/Task"},"taskId":{"type":"string"},"timerTriggers":{"description":"SLA fields","type":"array","items":{"$ref":"#/components/schemas/TimerTrigger"}},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"}}},"TaskCondition":{"type":"object","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}},"description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)"},"ContinueOnErrorType":{"title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.","type":"string"},"EvidenceData":{"type":"object","properties":{"customFields":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"},"description":"This field must have empty json key"},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"EvidenceData - all evidence properties to evaluate in task process"},"FieldMapping":{"type":"object","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"FieldMapping - Map a task output (complex or simple value) to an incident field"},"DataCollectionForm":{"title":"DataCollectionForm - a data collection form with questions.","type":"object","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"title":"FormDisplay - display options for communication/ask task (for both email and web forms).","type":"object","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"NotifiableItem":{"title":"NotifiableItem ...","type":"object","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."},"SLA":{"title":"SLA ...","type":"object","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"Task":{"type":"object","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}},"description":"Task is the basic task in the task repository that can be associated to an incident via playbook"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"TimerTrigger":{"title":"TimerTrigger ...","type":"object","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"title":"TimerAction ...","type":"string"},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}} ``` ## The PlaybookInput object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"PlaybookInput":{"type":"object","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"PlaybookInput represents the playbook input"},"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The PlaybookInputQuery object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"}}}} ``` ## The PlaybookInputs object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"PlaybookInput represents the playbook input"},"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The PlaybookOutput object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"PlaybookOutput":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"PlaybookOutput represents the playbook output"},"OutputType":{"title":"OutputType ...","type":"string"}}}} ``` ## The PlaybookOutputs object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"PlaybookOutput represents the playbook output"},"OutputType":{"title":"OutputType ...","type":"string"}}}} ``` ## The PlaybookTask object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"PlaybookTask":{"type":"object","title":"PlaybookTask ...","properties":{"conditions":{"description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","type":"array","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"id":{"type":"string"},"ignoreWorker":{"description":"Do not run this task in a worker","type":"boolean"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skipUnavailable":{"description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto","type":"boolean"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"task":{"$ref":"#/components/schemas/Task"},"taskId":{"type":"string"},"timerTriggers":{"description":"SLA fields","type":"array","items":{"$ref":"#/components/schemas/TimerTrigger"}},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"}}},"TaskCondition":{"type":"object","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}},"description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)"},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ContinueOnErrorType":{"title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.","type":"string"},"EvidenceData":{"type":"object","properties":{"customFields":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"},"description":"This field must have empty json key"},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"EvidenceData - all evidence properties to evaluate in task process"},"FieldMapping":{"type":"object","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"FieldMapping - Map a task output (complex or simple value) to an incident field"},"DataCollectionForm":{"title":"DataCollectionForm - a data collection form with questions.","type":"object","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"title":"FormDisplay - display options for communication/ask task (for both email and web forms).","type":"object","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"NotifiableItem":{"title":"NotifiableItem ...","type":"object","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."},"SLA":{"title":"SLA ...","type":"object","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"Task":{"type":"object","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}},"description":"Task is the basic task in the task repository that can be associated to an incident via playbook"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"TimerTrigger":{"title":"TimerTrigger ...","type":"object","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"title":"TimerAction ...","type":"string"},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}} ``` ## The PlaybookView object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}} ``` ## The playbookWithWarnings object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"playbookWithWarnings":{"type":"object","properties":{"playbook":{"$ref":"#/components/schemas/Playbook"},"warnings":{"type":"array","items":{"type":"string"}}}},"Playbook":{"description":"Playbook is a collection of tasks","type":"object","properties":{"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"brands":{"type":"array","items":{"type":"string"}},"cacheVersn":{"type":"integer","format":"int64"},"commands":{"type":"array","items":{"type":"string"}},"comment":{"type":"string"},"commitMessage":{"type":"string"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"description":"Who has created this event - relevant only for manual incidents","type":"string"},"definitionId":{"type":"string"},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"encTasks":{"type":"string"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"hasRole":{"description":"Internal field to make queries on role faster","type":"boolean"},"hidden":{"type":"boolean"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"inputs":{"$ref":"#/components/schemas/PlaybookInputs"},"itemVersion":{"$ref":"#/components/schemas/Version"},"locked":{"type":"boolean"},"missingScriptsIds":{"type":"array","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"nameRaw":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"outputs":{"$ref":"#/components/schemas/PlaybookOutputs"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"prevName":{"type":"string"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"description":"Do not change this field manually","type":"array","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"private":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"quiet":{"type":"boolean"},"remote":{"type":"boolean"},"roles":{"description":"The role assigned to this investigation","type":"array","items":{"type":"string"}},"scriptIds":{"type":"array","items":{"type":"string"}},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"sourcePlaybookID":{"type":"string"},"startTaskId":{"type":"string"},"syncHash":{"type":"string"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"taskIds":{"description":"auto generated field that will contain all task ids in this playbook\nNeeded for searching with bleve","type":"array","items":{"type":"string"}},"tasks":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/PlaybookTask"}},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"view":{"$ref":"#/components/schemas/PlaybookView"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}}},"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."},"PlaybookInputs":{"type":"array","description":"PlaybookInputs - array of PlaybookInput","items":{"$ref":"#/components/schemas/PlaybookInput"}},"PlaybookInput":{"type":"object","properties":{"description":{"type":"string"},"key":{"type":"string"},"playbookInputQuery":{"$ref":"#/components/schemas/PlaybookInputQuery"},"required":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"PlaybookInput represents the playbook input"},"PlaybookInputQuery":{"type":"object","properties":{"fromDate":{"type":"string","format":"date-time"},"fromDateLicense":{"type":"string","format":"date-time"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string"},"queryEntity":{"type":"string"},"queryState":{"$ref":"#/components/schemas/QueryState"},"results":{"type":"object","properties":{}},"runFromLastJobTime":{"type":"boolean"},"toDate":{"type":"string","format":"date-time"}},"description":"PlaybookInputQuery represents the playbook query input"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"PlaybookOutputs":{"type":"array","description":"PlaybookOutputs - array of PlaybookOutput","items":{"$ref":"#/components/schemas/PlaybookOutput"}},"PlaybookOutput":{"type":"object","properties":{"contextPath":{"type":"string"},"description":{"type":"string"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"PlaybookOutput represents the playbook output"},"OutputType":{"title":"OutputType ...","type":"string"},"PlaybookTask":{"type":"object","title":"PlaybookTask ...","properties":{"conditions":{"description":"Conditions - optional list of conditions to run when task is conditional. we check conditions by their order (e.i. - considering the first one that satisfied)","type":"array","items":{"$ref":"#/components/schemas/TaskCondition"}},"continueOnError":{"type":"boolean"},"continueOnErrorType":{"$ref":"#/components/schemas/ContinueOnErrorType"},"defaultAssignee":{"type":"string"},"defaultAssigneeComplex":{"$ref":"#/components/schemas/AdvanceArg"},"defaultReminder":{"type":"integer","format":"int64"},"evidenceData":{"$ref":"#/components/schemas/EvidenceData"},"externalFormUseAuth":{"type":"boolean"},"fieldMapping":{"type":"array","items":{"$ref":"#/components/schemas/FieldMapping"}},"form":{"$ref":"#/components/schemas/DataCollectionForm"},"formDisplay":{"$ref":"#/components/schemas/FormDisplay"},"id":{"type":"string"},"ignoreWorker":{"description":"Do not run this task in a worker","type":"boolean"},"isAutoSwitchedToQuietMode":{"type":"boolean"},"isOverSize":{"type":"boolean"},"loop":{"$ref":"#/components/schemas/TaskLoop"},"message":{"$ref":"#/components/schemas/NotifiableItem"},"nextTasks":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"note":{"type":"boolean"},"quietMode":{"$ref":"#/components/schemas/QuietMode"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"restrictedCompletion":{"type":"boolean"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"separateContext":{"type":"boolean"},"skipUnavailable":{"description":"SkipUnavailable if true then will check if automation exists, integration of that command is installed and\nactive or sub playbook exists in Demisto","type":"boolean"},"sla":{"$ref":"#/components/schemas/SLA"},"slaReminder":{"$ref":"#/components/schemas/SLA"},"task":{"$ref":"#/components/schemas/Task"},"taskId":{"type":"string"},"timerTriggers":{"description":"SLA fields","type":"array","items":{"$ref":"#/components/schemas/TimerTrigger"}},"type":{"$ref":"#/components/schemas/TaskType"},"view":{"$ref":"#/components/schemas/TaskView"}}},"TaskCondition":{"type":"object","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}},"description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)"},"ContinueOnErrorType":{"title":"ContinueOnErrorType there are different ways to handle an error. Ignore the error and proceed or handle it with error path.","type":"string"},"EvidenceData":{"type":"object","properties":{"customFields":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"},"description":"This field must have empty json key"},"description":{"$ref":"#/components/schemas/AdvanceArg"},"occurred":{"$ref":"#/components/schemas/AdvanceArg"},"tags":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"EvidenceData - all evidence properties to evaluate in task process"},"FieldMapping":{"type":"object","properties":{"fieldId":{"type":"string"},"output":{"$ref":"#/components/schemas/AdvanceArg"}},"description":"FieldMapping - Map a task output (complex or simple value) to an incident field"},"DataCollectionForm":{"title":"DataCollectionForm - a data collection form with questions.","type":"object","properties":{"description":{"type":"string"},"expired":{"type":"boolean"},"questions":{"type":"array","items":{"$ref":"#/components/schemas/Question"}},"sender":{"type":"string"},"title":{"type":"string"},"totalAnswers":{"type":"integer","format":"uint64"}}},"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"FormDisplay":{"title":"FormDisplay - display options for communication/ask task (for both email and web forms).","type":"object","properties":{"bodyBackgroundColor":{"type":"string"},"bodyFontColor":{"type":"string"},"headerBackgroundColor":{"type":"string"},"headerFontColor":{"type":"string"},"isExternalRtl":{"type":"boolean"},"sender":{"type":"string"},"submitButtonBackgroundColor":{"type":"string"},"submitButtonFontColor":{"type":"string"},"submitText":{"type":"string"}}},"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"NotifiableItem":{"title":"NotifiableItem ...","type":"object","properties":{"bcc":{"$ref":"#/components/schemas/AdvanceArg"},"body":{"$ref":"#/components/schemas/AdvanceArg"},"cc":{"$ref":"#/components/schemas/AdvanceArg"},"defaultOption":{"type":"string"},"format":{"type":"string"},"methods":{"type":"array","items":{"type":"string"}},"replyOptions":{"type":"array","items":{"type":"string"}},"subject":{"$ref":"#/components/schemas/AdvanceArg"},"timings":{"$ref":"#/components/schemas/NotifyTimings"},"to":{"$ref":"#/components/schemas/AdvanceArg"}}},"NotifyTimings":{"title":"NotifyTimings - time control on notify items - retries max count and intervals.","type":"object","properties":{"completeAfterReplies":{"type":"integer","format":"uint64"},"completeAfterSLA":{"type":"boolean"},"completeAfterV2":{"type":"boolean"},"retriesCount":{"type":"integer","format":"uint64"},"retriesInterval":{"type":"integer","format":"uint64"}}},"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."},"SLA":{"title":"SLA ...","type":"object","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}},"Task":{"type":"object","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}},"description":"Task is the basic task in the task repository that can be associated to an incident via playbook"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"},"TimerTrigger":{"title":"TimerTrigger ...","type":"object","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"title":"TimerAction ...","type":"string"},"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"},"PlaybookView":{"type":"object","description":"PlaybookView represents the view in client of playbook graph"}}}} ``` ## The QueryState object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"QueryState":{"type":"object","properties":{"batchSize":{"type":"integer","format":"int64"},"currentPage":{"type":"integer","format":"int64"},"searchAfter":{"type":"array","items":{"type":"string"}},"totalResults":{"type":"integer","format":"int64"}},"description":"QueryState represents the playbook query state"}}}} ``` ## The Question object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Question":{"title":"Question - question for a form with a given type.","type":"object","properties":{"columns":{"type":"array","items":{"$ref":"#/components/schemas/GridColumn"}},"defaultRows":{"type":"array","items":{"type":"object","additionalProperties":{"type":"object","properties":{}}}},"fieldAssociated":{"type":"string"},"id":{"type":"string"},"label":{"type":"string"},"labelArg":{"$ref":"#/components/schemas/AdvanceArg"},"options":{"type":"array","items":{"type":"string"}},"optionsArg":{"type":"array","items":{"$ref":"#/components/schemas/AdvanceArg"}},"placeholder":{"type":"string"},"readOnly":{"type":"boolean"},"required":{"type":"boolean"},"tooltip":{"type":"string"},"type":{"type":"string"}}},"GridColumn":{"title":"GridColumn","type":"object","properties":{"displayName":{"type":"string"},"fieldCalcScript":{"type":"string"},"isDefault":{"type":"boolean"},"isReadOnly":{"type":"boolean"},"key":{"type":"string"},"orgType":{"type":"string"},"required":{"type":"boolean"},"script":{"type":"string"},"selectValues":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"width":{"type":"integer","format":"int64"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The QuietMode object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"QuietMode":{"type":"integer","description":"QuietMode quiet mode for playbook task","format":"int64"}}}} ``` ## The RawFeedIndicator object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"RawFeedIndicator":{"description":"RawFeedIndicator is an unparsed feed indicator from JSON ingestion","type":"object","additionalProperties":{"type":"object"}}}}} ``` ## The RelationshipAPI object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The RelationshipsAPI object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"RelationshipsAPI":{"title":"RelationshipsAPI","type":"array","items":{"$ref":"#/components/schemas/RelationshipAPI"}},"RelationshipAPI":{"title":"RelationshipAPI","type":"object","properties":{"brand":{"type":"string"},"entityA":{"type":"string"},"entityAFamily":{"type":"string"},"entityAType":{"type":"string"},"entityB":{"type":"string"},"entityBFamily":{"type":"string"},"entityBType":{"type":"string"},"fields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"instance":{"type":"string"},"name":{"type":"string"},"reliability":{"$ref":"#/components/schemas/Reliability"},"reverseName":{"type":"string"},"startTime":{"type":"string","format":"date-time"},"type":{"type":"string"}},"description":""},"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The Reliability object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Reliability":{"title":"Reliability","type":"string"}}}} ``` ## The reply object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"reply":{"title":"reply","type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}},"description":"The query result upon error."}}}} ``` ## The ReputationCalcAlg object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."}}}} ``` ## The RunStatus object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."}}}} ``` ## The ScriptAPI object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ScriptAPI":{"title":"ScriptAPI ...","type":"object","properties":{"arguments":{"type":"array","items":{"$ref":"#/components/schemas/Argument"}},"comment":{"type":"string"},"contextKeys":{"type":"array","items":{"type":"string"}},"dependsOn":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"deprecated":{"type":"boolean"},"detached":{"type":"boolean"},"dockerImage":{"type":"string"},"enabled":{"type":"boolean"},"hidden":{"type":"boolean"},"id":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/Output"}},"permitted":{"type":"boolean"},"polling":{"type":"boolean"},"propagationLabels":{"type":"array","items":{"type":"string"}},"roles":{"type":"array","items":{"type":"string"}},"runAs":{"type":"string"},"scriptTarget":{"$ref":"#/components/schemas/ScriptTarget"},"system":{"type":"boolean"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/ScriptType"},"user":{"type":"string"},"version":{"type":"integer","format":"int64"}}},"Argument":{"type":"object","properties":{"auto":{"type":"string"},"default":{"type":"boolean"},"defaultValue":{"type":"string"},"deprecated":{"type":"boolean"},"description":{"type":"string"},"hidden":{"type":"boolean"},"isArray":{"type":"boolean"},"name":{"type":"string"},"predefined":{"type":"array","items":{"type":"string"}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"type":{"$ref":"#/components/schemas/ArgumentType"}},"description":"Argument to a module command"},"ArgumentType":{"title":"ArgumentType ...","type":"string"},"Output":{"type":"object","properties":{"contentPath":{"type":"string"},"contextPath":{"type":"string"},"description":{"type":"object","properties":{},"description":"Description is either a string or a map from string to interface"},"type":{"$ref":"#/components/schemas/OutputType"}},"description":"Output of a module command"},"OutputType":{"title":"OutputType ...","type":"string"},"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"},"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}} ``` ## The ScriptSubType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ScriptSubType":{"type":"string","description":"ScriptSubType holds the script type version"}}}} ``` ## The ScriptTarget object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ScriptTarget":{"type":"integer","description":"ScriptTarget represents the module where this script should run","format":"int64"}}}} ``` ## The ScriptType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ScriptType":{"type":"string","description":"ScriptType holds the type of a script"}}}} ``` ## The SLA object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SLA":{"title":"SLA ...","type":"object","properties":{"days":{"type":"integer","format":"int64"},"hours":{"type":"integer","format":"int64"},"minutes":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"}}}}}} ``` ## The SLADurationUnit object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SLADurationUnit":{"type":"integer","description":"SLADurationUnit is a helper to calculate if SLA in hours or minutes","format":"int64"}}}} ``` ## The SLAState object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"}}}} ``` ## The SearchIncidentsData object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SearchIncidentsData":{"title":"SearchIncidentsData","type":"object","properties":{"filter":{"$ref":"#/components/schemas/IncidentFilter"}}},"IncidentFilter":{"title":"IncidentFilter","type":"object","description":"IncidentFilter allows for very simple filtering.","properties":{"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"files":{"type":"array","items":{"type":"string"}},"fromDate":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 25.","format":"int64","default":25},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}}}},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## The Severity object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"}}}} ``` ## The StatsResponseWithReferenceLine object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"StatsResponseWithReferenceLine":{"type":"object","title":"StatsResponseWithReferenceLine - Describe the data returned related to a specific Line/Column chart widget cell in a dashboard.","properties":{"groups":{"$ref":"#/components/schemas/Groups"},"referenceLineY":{"type":"number","format":"double"}}},"Groups":{"description":"Groups is a list of group entities","type":"array","items":{"$ref":"#/components/schemas/Group"}},"Group":{"type":"object","title":"Group is the response that returns from a statistics query, describing a grouped value.","properties":{"color":{"description":"color used to identify the group","type":"string"},"count":{"description":"The number of participants in the group","type":"integer","format":"int64"},"data":{"description":"The data value provided in array of integer values.","type":"array","items":{"type":"integer","format":"int64"}},"dataType":{"type":"string"},"floatData":{"description":"The data value provided in array of float values.","type":"array","items":{"type":"number","format":"double"}},"groups":{"$ref":"#/components/schemas/Groups"},"name":{"type":"string"},"pivot":{"type":"string"},"query":{"type":"string"},"x":{"type":"number","format":"double"},"y":{"type":"number","format":"double"},"z":{"type":"number","format":"double"}}}}}} ``` ## The StatsTextResponse object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"StatsTextResponse":{"type":"object","title":"StatsTextResponse - Describe the data returned related to a specific text widget cell in a dashboard.","properties":{"groups":{"$ref":"#/components/schemas/Groups"},"text":{"description":"Describe the complete text for the text widget, after placeholders injection.","type":"string"}}},"Groups":{"description":"Groups is a list of group entities","type":"array","items":{"$ref":"#/components/schemas/Group"}},"Group":{"type":"object","title":"Group is the response that returns from a statistics query, describing a grouped value.","properties":{"color":{"description":"color used to identify the group","type":"string"},"count":{"description":"The number of participants in the group","type":"integer","format":"int64"},"data":{"description":"The data value provided in array of integer values.","type":"array","items":{"type":"integer","format":"int64"}},"dataType":{"type":"string"},"floatData":{"description":"The data value provided in array of float values.","type":"array","items":{"type":"number","format":"double"}},"groups":{"$ref":"#/components/schemas/Groups"},"name":{"type":"string"},"pivot":{"type":"string"},"query":{"type":"string"},"x":{"type":"number","format":"double"},"y":{"type":"number","format":"double"},"z":{"type":"number","format":"double"}}}}}} ``` ## The StatsTrendsResponse object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"StatsTrendsResponse":{"description":"StatsTrendsResponse - Represent a trend response from statistics. Provides information about\nthe current value and the previous value based on the period.","type":"object","properties":{"currSum":{"type":"number","format":"double"},"prevSum":{"type":"number","format":"double"}}}}}} ``` ## The System object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"System":{"description":"System - URL stands for ip or hostname","type":"object","properties":{"agent":{"$ref":"#/components/schemas/SystemAgent"},"arch":{"type":"string"},"ciphers":{"type":"array","items":{"type":"string"}},"credentials":{"type":"string"},"engineId":{"type":"string"},"host":{"type":"string"},"integrationinstanceid":{"type":"string"},"issharedagent":{"type":"boolean"},"name":{"type":"string"},"os":{"type":"string"},"password":{"type":"string"},"servicesID":{"type":"string"},"smb":{"type":"integer","format":"int64"},"smbport":{"type":"integer","format":"uint16"},"sshkey":{"type":"string"},"sshport":{"type":"integer","format":"uint16"},"terminalOptions":{"$ref":"#/components/schemas/TerminalOptions"},"user":{"type":"string"},"workgroup":{"type":"string"}}},"SystemAgent":{"description":"SystemAgent - represents agent status and holds server context","type":"object","properties":{"servercontext":{"type":"array","items":{"type":"integer","format":"uint8"}}}},"TerminalOptions":{"description":"TerminalOptions - terminal options to use in case of using pty","type":"object","properties":{"Echo":{"type":"integer","format":"uint32"},"Terminal":{"type":"boolean"},"TerminalHeight":{"type":"integer","format":"int64"},"TerminalType":{"type":"string"},"TerminalWidth":{"type":"integer","format":"int64"},"TyISpeed":{"type":"integer","format":"uint32"},"TyOSpeed":{"type":"integer","format":"uint32"}}}}}} ``` ## The SystemAgent object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SystemAgent":{"description":"SystemAgent - represents agent status and holds server context","type":"object","properties":{"servercontext":{"type":"array","items":{"type":"integer","format":"uint8"}}}}}}} ``` ## The Task object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Task":{"type":"object","properties":{"brand":{"type":"string"},"cacheVersn":{"type":"integer","format":"int64"},"clonedFrom":{"type":"string"},"comment":{"type":"string"},"conditions":{"type":"array","items":{"type":"string"}},"created":{"type":"string","format":"date-time"},"description":{"type":"string"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"isCommand":{"type":"boolean"},"isLocked":{"type":"boolean"},"isTitleTask":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"playbookId":{"type":"string"},"playbookName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"scriptId":{"type":"string"},"sequenceNumber":{"type":"integer","format":"int64"},"sizeInBytes":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"type":{"$ref":"#/components/schemas/TaskType"},"version":{"type":"integer","format":"int64"}},"description":"Task is the basic task in the task repository that can be associated to an incident via playbook"},"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"}}}} ``` ## The TaskCondition object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TaskCondition":{"type":"object","properties":{"condition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"label":{"type":"string"}},"description":"TaskCondition - contains a condition and a corresponding label\nif the condition satisfied - its label is taken as the next task(s) input (e.i. the label on the edge)"},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"}}}} ``` ## The TaskLoop object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TaskLoop":{"type":"object","properties":{"brand":{"type":"string"},"builtinCondition":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"exitCondition":{"type":"string"},"forEach":{"type":"boolean"},"isCommand":{"type":"boolean"},"max":{"type":"integer","format":"int64"},"scriptArguments":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"scriptId":{"type":"string"},"scriptName":{"type":"string"},"wait":{"type":"integer","format":"int64"}},"description":"TaskLoop contains loop details"},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"}}}} ``` ## The TaskState object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TaskState":{"type":"string","description":"TaskState indicates the state of the task during the incident/investigation execution"}}}} ``` ## The TaskType object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TaskType":{"type":"string","description":"TaskType is the Task in the playbook context as a node"}}}} ``` ## The TaskView object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TaskView":{"type":"object","description":"TaskView represents the view in client of the tasks graph"}}}} ``` ## The TerminalOptions object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TerminalOptions":{"description":"TerminalOptions - terminal options to use in case of using pty","type":"object","properties":{"Echo":{"type":"integer","format":"uint32"},"Terminal":{"type":"boolean"},"TerminalHeight":{"type":"integer","format":"int64"},"TerminalType":{"type":"string"},"TerminalWidth":{"type":"integer","format":"int64"},"TyISpeed":{"type":"integer","format":"uint32"},"TyOSpeed":{"type":"integer","format":"uint32"}}}}}} ``` ## The TimerAction object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TimerAction":{"title":"TimerAction ...","type":"string"}}}} ``` ## The TimerTrigger object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TimerTrigger":{"title":"TimerTrigger ...","type":"object","properties":{"action":{"$ref":"#/components/schemas/TimerAction"},"fieldName":{"type":"string"}}},"TimerAction":{"title":"TimerAction ...","type":"string"}}}} ``` ## The TransformerOperatorID object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"}}}} ``` ## The UpdateDataBatch object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"UpdateDataBatch":{"type":"object","title":"UpdateDataBatch ...","properties":{"CustomFields":{"type":"object","additionalProperties":{"type":"object"}},"all":{"type":"boolean","description":"When `all` is `true`, all of the incidents are exported to CSV. \r\n\r\n**Note:** When `all`:`true`, all settings relating to page size and number are ignored."},"closeNotes":{"type":"string"},"closeReason":{"type":"string"},"columns":{"type":"array","items":{"type":"string"}},"data":{"type":"object","additionalProperties":{"type":"object"}},"filter":{"$ref":"#/components/schemas/IncidentFilter"},"force":{"type":"boolean"},"ids":{"type":"array","description":"Specify the list of incident IDs to be included in the CSV file. \r\n\r\n**Note:** When you choose to specify the IDs, all settings relating to page size and number are ignored.","items":{"type":"string"}},"line":{"type":"string"},"originalIncidentId":{"type":"string"},"overrideInvestigation":{"type":"boolean"}}},"IncidentFilter":{"title":"IncidentFilter","type":"object","description":"IncidentFilter allows for very simple filtering.","properties":{"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"files":{"type":"array","items":{"type":"string"}},"fromDate":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 25.","format":"int64","default":25},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}}}},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## The updateEntry object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"updateEntry":{"type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/AdvanceArg"}},"data":{"type":"string"},"id":{"type":"string"},"investigationId":{"type":"string"}}},"AdvanceArg":{"title":"AdvanceArg - advance argument can be one of the following:","type":"object","properties":{"complex":{"$ref":"#/components/schemas/ComplexArg"},"keyValue":{"type":"array","items":{"$ref":"#/components/schemas/KeyValueArg"}},"simple":{"type":"string"}},"description":"Simple: plain text such as \"hello\" (constant) or ${File.ID} (DT expression)\nComplex: struct with all info that is necessary to compute argument value from context (Root, Filters, Accessor & Transformers)]\nKeyValue: list of key-value"},"ComplexArg":{"type":"object","properties":{"accessor":{"type":"string"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/ArgFilter"}},"root":{"type":"string"},"transformers":{"type":"array","items":{"$ref":"#/components/schemas/ArgTransformer"}}},"description":"**ComplexArg:** All information that is necessary to compute argument value from context.\n\n**Root:** The object to work against.\n\n**Filters:** A collection of filters to apply to the root object, one after another (with logical AND condition between each one).\n\n**Accessor:** The key to access each result after filter.\n\n**Transformers:** A collection of transformers to apply on the result of the accessed key from each result. \n\nExample: If you want to take from context all `File.DisplayName` where `File.Extension` is `EXE`, and return the result in uppercase: `Root` is \"File\", `Filters` is \"File.DisplayName where File.Extension is 'EXE'\" query, `Accessor`:` is \"DisplayName\", and `Transformers` includes the uppercase transformation."},"ArgFilter":{"type":"array","description":"ArgFilter - represent a slice of atomic filters with OR condition between them (e.i. - atomic1 OR atomic2 OR ...)","items":{"$ref":"#/components/schemas/ArgAtomicFilter"}},"ArgAtomicFilter":{"type":"object","properties":{"ignoreCase":{"type":"boolean"},"left":{"$ref":"#/components/schemas/OperatorArgument"},"operator":{"$ref":"#/components/schemas/FilterOperatorID"},"right":{"$ref":"#/components/schemas/OperatorArgument"},"type":{"type":"string"}},"description":"ArgAtomicFilter - operator with two sides that return true/false"},"OperatorArgument":{"title":"OperatorArgument ...","type":"object","properties":{"isContext":{"type":"boolean"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}},"FilterOperatorID":{"title":"FilterOperatorID ...","type":"string"},"ArgTransformer":{"title":"ArgTransformer ...","type":"object","properties":{"args":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/OperatorArgument"}},"operator":{"$ref":"#/components/schemas/TransformerOperatorID"}}},"TransformerOperatorID":{"title":"TransformerOperatorID ...","type":"string"},"KeyValueArg":{"title":"KeyValueArg ...","type":"object","properties":{"key":{"type":"string"},"value":{"$ref":"#/components/schemas/AdvanceArg"}}}}}} ``` ## The updateEntryTags object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"updateEntryTags":{"type":"object","properties":{"id":{"type":"string"},"investigationId":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}}}}}}} ``` ## The UpdateResponse object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"UpdateResponse":{"type":"object","title":"UpdateResponse ...","properties":{"notUpdated":{"type":"integer","format":"int64"},"updatedIds":{"type":"array","items":{"type":"string"}},"uppdated":{"type":"integer","format":"int64"}}}}}} ``` ## The Version object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."}}}} ``` ## The WhitelistedIndicator object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"WhitelistedIndicator":{"type":"object","description":"WhitelistedIndicator Excluded indicator","properties":{"created":{"type":"string","format":"date-time"},"id":{"type":"string"},"locked":{"type":"boolean"},"reason":{"type":"string"},"reputations":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"value":{"type":"string"},"whitelistTime":{"type":"string","format":"date-time"}}}}}} ``` ## The securityDefinitions object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"securityDefinitions":{"type":"object"}}}} ``` ## The SystemDiagnosticsResponse object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SystemDiagnosticsResponse":{"type":"object","required":["reply"],"properties":{"reply":{"$ref":"#/components/schemas/SystemDiagnosticsResults"}}},"SystemDiagnosticsResults":{"type":"object","required":["results"],"properties":{"results":{"type":"array","description":"List of system diagnostics snapshots ordered by timestamp descending (most recent first).","items":{"$ref":"#/components/schemas/SystemDiagnosticsSnapshot"}}}},"SystemDiagnosticsSnapshot":{"type":"object","description":"A point-in-time system diagnostics snapshot.","required":["timestamp"],"properties":{"timestamp":{"type":"string","format":"date-time","description":"ISO 8601 UTC timestamp of the diagnostics snapshot."},"nodes":{"type":"array","description":"List of node-level health metrics.","items":{"$ref":"#/components/schemas/NodeMetrics"}},"cluster_disk_usage":{"type":"number","format":"float","nullable":true,"description":"Cluster-wide disk usage percentage (0.0–100.0)."},"components":{"type":"object","description":"Component group names mapped to their health status. Possible statuses: HEALTHY, WARNING, ERROR.","additionalProperties":{"type":"string","enum":["HEALTHY","WARNING","ERROR"]}},"storage":{"type":"object","description":"Storage group names mapped to their usage percentage.","additionalProperties":{"type":"number","format":"float"}},"queues":{"type":"object","description":"Queue names mapped to their current depth (number of items).","additionalProperties":{"type":"integer"}},"connectivity":{"$ref":"#/components/schemas/ConnectivityStatus"}}},"NodeMetrics":{"type":"object","description":"Health metrics for a single cluster node.","required":["name","connected"],"properties":{"name":{"type":"string","description":"Node name identifier (typically the hostname or IP-based name)."},"cpu_usage":{"type":"number","format":"float","nullable":true,"description":"CPU usage percentage (0.0–100.0)."},"memory_usage":{"type":"number","format":"float","nullable":true,"description":"Memory usage percentage (0.0–100.0)."},"os_disk_usage":{"type":"number","format":"float","nullable":true,"description":"OS disk usage percentage (0.0–100.0)."},"connected":{"type":"boolean","description":"Whether the node is currently connected and reporting metrics."}}},"ConnectivityStatus":{"type":"object","description":"External connectivity status to Palo Alto Networks cloud services.","required":["connected"],"properties":{"connected":{"type":"boolean","description":"Whether external connectivity is currently established."},"since":{"type":"string","format":"date-time","nullable":true,"description":"ISO 8601 UTC timestamp of when the current connectivity status began. Null if no connectivity data is available."},"error":{"type":"string","nullable":true,"description":"Error message describing the connectivity issue. Null when connected successfully."}}}}}} ``` ## The SystemDiagnosticsResults object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SystemDiagnosticsResults":{"type":"object","required":["results"],"properties":{"results":{"type":"array","description":"List of system diagnostics snapshots ordered by timestamp descending (most recent first).","items":{"$ref":"#/components/schemas/SystemDiagnosticsSnapshot"}}}},"SystemDiagnosticsSnapshot":{"type":"object","description":"A point-in-time system diagnostics snapshot.","required":["timestamp"],"properties":{"timestamp":{"type":"string","format":"date-time","description":"ISO 8601 UTC timestamp of the diagnostics snapshot."},"nodes":{"type":"array","description":"List of node-level health metrics.","items":{"$ref":"#/components/schemas/NodeMetrics"}},"cluster_disk_usage":{"type":"number","format":"float","nullable":true,"description":"Cluster-wide disk usage percentage (0.0–100.0)."},"components":{"type":"object","description":"Component group names mapped to their health status. Possible statuses: HEALTHY, WARNING, ERROR.","additionalProperties":{"type":"string","enum":["HEALTHY","WARNING","ERROR"]}},"storage":{"type":"object","description":"Storage group names mapped to their usage percentage.","additionalProperties":{"type":"number","format":"float"}},"queues":{"type":"object","description":"Queue names mapped to their current depth (number of items).","additionalProperties":{"type":"integer"}},"connectivity":{"$ref":"#/components/schemas/ConnectivityStatus"}}},"NodeMetrics":{"type":"object","description":"Health metrics for a single cluster node.","required":["name","connected"],"properties":{"name":{"type":"string","description":"Node name identifier (typically the hostname or IP-based name)."},"cpu_usage":{"type":"number","format":"float","nullable":true,"description":"CPU usage percentage (0.0–100.0)."},"memory_usage":{"type":"number","format":"float","nullable":true,"description":"Memory usage percentage (0.0–100.0)."},"os_disk_usage":{"type":"number","format":"float","nullable":true,"description":"OS disk usage percentage (0.0–100.0)."},"connected":{"type":"boolean","description":"Whether the node is currently connected and reporting metrics."}}},"ConnectivityStatus":{"type":"object","description":"External connectivity status to Palo Alto Networks cloud services.","required":["connected"],"properties":{"connected":{"type":"boolean","description":"Whether external connectivity is currently established."},"since":{"type":"string","format":"date-time","nullable":true,"description":"ISO 8601 UTC timestamp of when the current connectivity status began. Null if no connectivity data is available."},"error":{"type":"string","nullable":true,"description":"Error message describing the connectivity issue. Null when connected successfully."}}}}}} ``` ## The SystemDiagnosticsSnapshot object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"SystemDiagnosticsSnapshot":{"type":"object","description":"A point-in-time system diagnostics snapshot.","required":["timestamp"],"properties":{"timestamp":{"type":"string","format":"date-time","description":"ISO 8601 UTC timestamp of the diagnostics snapshot."},"nodes":{"type":"array","description":"List of node-level health metrics.","items":{"$ref":"#/components/schemas/NodeMetrics"}},"cluster_disk_usage":{"type":"number","format":"float","nullable":true,"description":"Cluster-wide disk usage percentage (0.0–100.0)."},"components":{"type":"object","description":"Component group names mapped to their health status. Possible statuses: HEALTHY, WARNING, ERROR.","additionalProperties":{"type":"string","enum":["HEALTHY","WARNING","ERROR"]}},"storage":{"type":"object","description":"Storage group names mapped to their usage percentage.","additionalProperties":{"type":"number","format":"float"}},"queues":{"type":"object","description":"Queue names mapped to their current depth (number of items).","additionalProperties":{"type":"integer"}},"connectivity":{"$ref":"#/components/schemas/ConnectivityStatus"}}},"NodeMetrics":{"type":"object","description":"Health metrics for a single cluster node.","required":["name","connected"],"properties":{"name":{"type":"string","description":"Node name identifier (typically the hostname or IP-based name)."},"cpu_usage":{"type":"number","format":"float","nullable":true,"description":"CPU usage percentage (0.0–100.0)."},"memory_usage":{"type":"number","format":"float","nullable":true,"description":"Memory usage percentage (0.0–100.0)."},"os_disk_usage":{"type":"number","format":"float","nullable":true,"description":"OS disk usage percentage (0.0–100.0)."},"connected":{"type":"boolean","description":"Whether the node is currently connected and reporting metrics."}}},"ConnectivityStatus":{"type":"object","description":"External connectivity status to Palo Alto Networks cloud services.","required":["connected"],"properties":{"connected":{"type":"boolean","description":"Whether external connectivity is currently established."},"since":{"type":"string","format":"date-time","nullable":true,"description":"ISO 8601 UTC timestamp of when the current connectivity status began. Null if no connectivity data is available."},"error":{"type":"string","nullable":true,"description":"Error message describing the connectivity issue. Null when connected successfully."}}}}}} ``` ## The NodeMetrics object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"NodeMetrics":{"type":"object","description":"Health metrics for a single cluster node.","required":["name","connected"],"properties":{"name":{"type":"string","description":"Node name identifier (typically the hostname or IP-based name)."},"cpu_usage":{"type":"number","format":"float","nullable":true,"description":"CPU usage percentage (0.0–100.0)."},"memory_usage":{"type":"number","format":"float","nullable":true,"description":"Memory usage percentage (0.0–100.0)."},"os_disk_usage":{"type":"number","format":"float","nullable":true,"description":"OS disk usage percentage (0.0–100.0)."},"connected":{"type":"boolean","description":"Whether the node is currently connected and reporting metrics."}}}}}} ``` ## The ConnectivityStatus object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ConnectivityStatus":{"type":"object","description":"External connectivity status to Palo Alto Networks cloud services.","required":["connected"],"properties":{"connected":{"type":"boolean","description":"Whether external connectivity is currently established."},"since":{"type":"string","format":"date-time","nullable":true,"description":"ISO 8601 UTC timestamp of when the current connectivity status began. Null if no connectivity data is available."},"error":{"type":"string","nullable":true,"description":"Error message describing the connectivity issue. Null when connected successfully."}}}}}} ``` ## The ErrorResponse object ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","nullable":true,"description":"Additional information describing the error."}}}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/models.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.