Scripts
APIs for managing scripts
Retrieve detailed information about the specified script. You can use the script name or script ID as the path parameter to identify the script.
Path parameters
script_idstringRequired
Responses
200
OK
application/json
cacheVersnintegerOptional
commentstringOptional
commitMessagestringOptional
contextKeysobject[]Optional
definitionIdstringOptional
deprecatedbooleanOptional
detachedbooleanOptional
dockerImagestringOptional
enabledbooleanOptional
enginestringOptional
engineGroupstringOptional
fromServerVersionstringOptional
idstringOptional
itemVersionstringOptional
lockedbooleanOptional
modifiedstringOptional
namestringOptional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
permittedbooleanOptional
prevNamestringOptional
primaryTermintegerOptional
propagationLabelsobject[]Optional
pswdstringOptional
pswdProtectedbooleanOptional
rawTagsstring[]Optional
runAsstringOptional
runOncebooleanOptional
scriptstringOptional
scriptTargetintegerOptional
searchableNamestringOptional
sensitivebooleanOptional
sequenceNumberintegerOptional
shouldCommitbooleanOptional
subtypestringOptional
systembooleanOptional
tagsstring[]Optional
timeoutintegerOptional
toServerVersionstringOptional
typestringOptional
userstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versionintegerOptional
visualScriptstringOptional
post/xsoar/public/v1/automation/load/{script_id}
POST /xsoar/public/v1/automation/load/{script_id} HTTP/1.1
Host: api-yourfqdn
Accept: */*
200
OK
{
"MainEngineInfo": {
"engine": "",
"engineGroup": ""
},
"arguments": [
{
"default": false,
"deprecated": false,
"description": "The HTML to extract tables from",
"hidden": false,
"name": "value",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "The title for tables",
"hidden": false,
"name": "title",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "Extract only the tables with given indexes - 0 based",
"hidden": false,
"name": "filter_indexes",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "Extract only the tables with given titles",
"hidden": false,
"name": "filter_titles",
"required": false,
"secret": false,
"type": ""
},
{
"auto": "PREDEFINED",
"default": false,
"defaultValue": "none",
"deprecated": false,
"description": "The default table line to consider as a header if no headers are in the table.",
"hidden": false,
"name": "default_header_line",
"predefined": [
"none",
"first_row",
"first_column"
],
"required": false,
"secret": false,
"type": ""
}
],
"cacheVersn": 0,
"comment": "Find tables inside HTML and extract the contents into objects using the following logic:\n\n- If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value\n- If table has a header row, create a table of objects where attribute names are the headers\n- If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3...",
"commitMessage": "",
"contextKeys": [],
"definitionId": "",
"deprecated": false,
"detached": false,
"dockerImage": "demisto/bs4-py3:1.0.0.86348",
"enabled": true,
"engine": "",
"engineGroup": "",
"fromServerVersion": "6.5.0",
"id": "ParseHTMLTables",
"important": null,
"itemVersion": "1.2.61",
"locked": false,
"modified": "2024-02-19T16:32:38.834515333Z",
"name": "ParseHTMLTables",
"nativeImage": null,
"outputs": null,
"packID": "FiltersAndTransformers",
"packName": "Filters And Transformers",
"packPropagationLabels": [
"all"
],
"permitted": true,
"prevName": "ParseHTMLTables",
"primaryTerm": 12,
"propagationLabels": [],
"pswd": "",
"pswdProtected": false,
"rawTags": [
"transformer",
"general"
],
"runAs": "DBotWeakRole",
"runOnce": false,
"script": "register_module_line('ParseHTMLTables', 'start', __line__())\n### pack version: 1.2.61\n\n\nimport copy\nfrom typing import Any, Dict, Generator, List, Optional, Tuple, Union\nfrom bs4 import BeautifulSoup, NavigableString, Tag\n\n\nTITLE_THRESHOLD = 4\n\n\nclass Table:\n def __init__(self, title: str):\n self.__title = title\n self.__headers: List[str] = []\n self.__rows: List[Tuple[List[str], List[str]]] = []\n self.__rowspan_labels: List[Tuple[int, str]] = []\n\n def __set_rowspan_labels(self, columns: Optional[List[Tag]]):\n if not columns or not any(col.attrs.get('rowspan') for col in columns):\n return\n\n rowspan_labels: List[Tuple[int, str]] = []\n for col in columns:\n try:\n rowspan = int(col.attrs.get('rowspan') or 1)\n except Exception:\n rowspan = 1\n rowspan = max(1, rowspan)\n\n try:\n colspan = int(col.attrs.get('colspan') or 1)\n except Exception:\n colspan = 1\n colspan = max(1, colspan)\n\n rowspan_labels += [(rowspan, col.text.strip())] * colspan\n\n self.__rowspan_labels = rowspan_labels\n\n def get_title(self) -> str:\n return self.__title\n\n def set_header_labels(self, headers: List[Tag]):\n self.__headers = [header.text.strip() for header in headers]\n\n def get_header_labels(self) -> List[str]:\n return self.__headers\n\n def add_row(self, columns: List[Tag], labels: Optional[List[Tag]] = None):\n \"\"\"\n Add a row with cells and labels.\n\n :param columns: List of data cells of the row.\n :param labels: List of header cells of the row.\n \"\"\"\n rowspan_labels = self.__rowspan_labels\n\n # Normalize labels\n if labels and any(label.attrs.get('rowspan') for label in labels):\n self.__set_rowspan_labels(labels)\n\n normalized_labels = []\n if labels:\n for i, (count, label) in enumerate(rowspan_labels):\n if count >= 2:\n normalized_labels.append(label)\n\n for label in labels:\n try:\n colspan = int(label.attrs.get('colspan') or 1)\n except Exception:\n colspan = 1\n normalized_labels += [label.text.strip()] * max(1, colspan)\n\n # Normalize columns\n if any(col.attrs.get('rowspan') for col in columns):\n self.__set_rowspan_labels(columns)\n\n normalized_columns = []\n for i, (count, label) in enumerate(rowspan_labels):\n if count >= 2:\n normalized_columns.append(label)\n rowspan_labels[i] = count - 1, label\n\n for col in columns:\n try:\n colspan = int(col.attrs.get('colspan') or 1)\n except Exception:\n colspan = 1\n normalized_columns += [col.text.strip()] * max(1, colspan)\n\n self.__rows.append((normalized_labels, normalized_columns))\n\n def get_rows(self) -> List[Tuple[List[str], List[str]]]:\n return self.__rows\n\n def make_pretty_table_rows(self, default_header_line: Optional[str] = None) -> Any:\n \"\"\"\n Format a table\n\n :param default_header_line: Which table line handles as header by default, 'first_column' or 'first_row'\n :return: The table formatted in JSON structure.\n \"\"\"\n rows: List[Union[str, Dict[str, Any]]] = []\n temp_row: Dict[str, Any] = {}\n\n tbl_rows = self.__rows\n headers = self.__headers\n\n if default_header_line and default_header_line != 'none':\n if not headers and not any(labels for labels, cols in tbl_rows):\n if default_header_line in ('first_column', 'first_row'):\n # The first column or row is considered as header\n if default_header_line == 'first_column':\n # transpose\n tbl_rows = [([], list(cols)) for cols in zip(*[cols for labels, cols in tbl_rows])]\n\n labels, headers = tbl_rows[0]\n tbl_rows = tbl_rows[1:]\n else:\n raise ValueError(f'Unknown default header line: {default_header_line}')\n\n for labels, cols in tbl_rows:\n labels = labels[-1:]\n headers = labels + headers[len(labels):len(headers) - len(labels)]\n\n if not cols:\n continue\n\n elif len(cols) == 1:\n if len(headers) >= 1:\n # If there 1 header and 1 column, treat as key-value\n key = headers[0]\n vals = temp_row.get(key)\n if vals is None:\n temp_row[key] = cols[0]\n elif type(vals) == list:\n temp_row[key] = vals + [cols[0]]\n else:\n temp_row[key] = [vals, cols[0]]\n else:\n if temp_row:\n rows.append(temp_row)\n temp_row = {}\n\n # Single value in a table - just create an array of strings\n rows.append(cols[0])\n\n elif len(cols) == 2 and len(headers) == 0:\n # If there are 2 columns and no headers, treat as key-value\n key = cols[0]\n vals = temp_row.get(key)\n if vals is None:\n temp_row[key] = cols[1]\n elif type(vals) == list:\n temp_row[key] = vals + [cols[1]]\n else:\n temp_row[key] = [vals, cols[1]]\n else:\n if temp_row:\n rows.append(temp_row)\n temp_row = {}\n\n rows.append({headers[i] if i < len(headers) else 'cell' + str(i): col for i, col in enumerate(cols)})\n\n if temp_row:\n rows.append(temp_row)\n\n if len(rows) == 1 and type(rows[0]) == dict:\n return rows[0]\n return rows\n\n\ndef find_table_title(base: Optional[Union[BeautifulSoup, Tag, NavigableString]],\n node: Union[BeautifulSoup, Tag, NavigableString]) -> Optional[str]:\n \"\"\"\n Search for a table title from a node.\n\n :param base: The top node of the tree.\n :param node: The node from which searching starts.\n :return: A title found.\n \"\"\"\n title = ''\n orig = node\n prev = node.previous_element\n while prev and node is not base:\n node = prev\n if isinstance(node, Tag) and node.name in ('h1', 'h2', 'h3', 'h4', 'h5', 'h6'):\n title = ' '.join(node.text.strip().split())\n break\n\n prev = node.previous_element\n\n if not title or title.count(' ') >= TITLE_THRESHOLD:\n message = ''\n node = orig\n prev = node.previous_element\n while prev and node is not base:\n node = prev\n if isinstance(node, NavigableString):\n message = (str(node) if message else str(node).rstrip()) + message\n if message.lstrip() and any(c in message for c in ('\\n', '\\r')):\n break\n\n prev = node.previous_element\n\n message = ' '.join(message.strip().split())\n title = title if title and message.count(' ') >= title.count(' ') else message\n\n return title\n\n\ndef list_columns(node: Union[BeautifulSoup, Tag, NavigableString], name: str) -> List[Tag]:\n \"\"\"\n List columns of the row.\n\n :param node: The node which contains columns of the row.\n :param name: The name of the tag of columns.\n :return: The list of columns.\n \"\"\"\n vals = []\n ancestor = node\n name_list = ['table', 'td', 'th', name]\n node = node.find(name_list)\n while node and is_descendant(ancestor, node):\n if node.name in name_list:\n if node.name == name:\n tnode = copy.copy(node)\n for t in tnode.find_all('table'):\n t.decompose()\n vals.append(tnode)\n node = node.find_next_sibling(True)\n else:\n node = node.find_next(name_list)\n return vals\n\n\ndef is_descendant(ancestor: Optional[Union[BeautifulSoup, Tag, NavigableString]],\n node: Optional[Union[BeautifulSoup, Tag, NavigableString]]) -> bool:\n \"\"\"\n Check if a node is descendant in the tree.\n\n :param ancestor: The ancestor node.\n :param node: The node to be checked.\n :return: True - node is descendant, False - node is not descendant.\n \"\"\"\n return ancestor is not None and node is not None and any([ancestor is p for p in node.parents])\n\n\ndef parse_table(base: Optional[Union[BeautifulSoup, Tag, NavigableString]],\n table_node: Union[BeautifulSoup, Tag, NavigableString]) -> Generator[Table, None, None]:\n \"\"\"\n Parse a HTML table and enumerate tables found in the table.\n\n :param base: The top node of the HTML tree.\n :param table_node: The table node to parse.\n :return: Tables found.\n \"\"\"\n table = Table(title=find_table_title(base, table_node) or 'No Title')\n has_nested_tables = False\n\n node = table_node.find(['table', 'tr'])\n while node and is_descendant(table_node, node):\n if node.name == 'tr':\n ths = list_columns(node, 'th')\n tds = list_columns(node, 'td')\n if tds:\n table.add_row(columns=tds, labels=ths)\n if ths and not table.get_header_labels():\n table.set_header_labels(ths)\n\n node = node.find_next(['table', 'tr'])\n\n elif node.name == 'table':\n has_nested_tables = True\n yield from parse_table(base, node)\n\n base = node.previous_element\n node = node.find_next_sibling(True)\n else:\n node = node.find_next(['table', 'tr'])\n\n # Not to make a table if tr only has tables\n has_table = True\n if has_nested_tables:\n rows = table.get_rows()\n if len(rows) == 1:\n labels, cols = rows[0]\n if len(cols) == 1 and not cols[0]:\n has_table = False\n\n if has_table:\n yield table\n\n\ndef parse_tables(node: Union[BeautifulSoup, Tag, NavigableString]) -> Generator[Table, None, None]:\n \"\"\"\n Parse HTML tables and enumerate them.\n\n :param node: The node from which searching starts.\n :return: Tables found.\n \"\"\"\n base = None\n node = node.find('table')\n while node:\n yield from parse_table(base, node)\n base = node.next_sibling\n\n while node:\n next = node.find_next_sibling(True)\n if next:\n if next.name == 'table':\n break\n\n next = next.find_next('table')\n if next:\n break\n node = node.parent\n node = next\n\n\ndef main():\n args = demisto.args()\n html = args.get('value') or ''\n overwriting_title = args.get('title')\n filter_indexes = argToList(args.get('filter_indexes'))\n filter_titles = argToList(args.get('filter_titles'))\n default_header_line = args.get('default_header_line') or 'none'\n\n tables = []\n try:\n soup = BeautifulSoup(html, 'html.parser')\n index = -1\n for table in parse_tables(soup):\n rows = table.make_pretty_table_rows(default_header_line)\n if not rows:\n continue\n\n index = index + 1\n if filter_indexes and\\\n index not in filter_indexes and\\\n str(index) not in filter_indexes:\n continue\n\n original_title = table.get_title()\n if filter_titles and original_title not in filter_titles:\n continue\n\n tables.append({overwriting_title or original_title: rows})\n\n except Exception as err:\n # Don't return an error by return_error() as this is transformer.\n raise DemistoException(str(err))\n\n return_results(tables)\n\n\nif __name__ in ('__main__', '__builtin__', 'builtins'):\n main()\n\nregister_module_line('ParseHTMLTables', 'end', __line__())\n",
"scriptTarget": 0,
"searchableName": "ParseHTMLTables",
"sensitive": false,
"sequenceNumber": 41221646,
"shouldCommit": false,
"sizeInBytes": 15106,
"subtype": "python3",
"system": true,
"tags": [
"transformer",
"general"
],
"timeout": 0,
"toServerVersion": "",
"type": "python",
"user": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 95,
"visualScript": ""
}Retrieve the metadata details for all scripts in this Cortex XSOAR tenant. Depending on the number of scripts in the instance, the response can be very large.
Responses
200
OK
application/json
idstringOptional
versionintegerOptional
namestringOptional
typestringOptional
tagsstring[]Optional
contextKeysobject[]Optional
commentstringOptional
enabledbooleanOptional
systembooleanOptional
detachedbooleanOptional
lockedbooleanOptional
userstringOptional
dockerImagestringOptional
modifiedstringOptional
scriptTargetintegerOptional
runAsstringOptional
permittedbooleanOptional
get/xsoar/public/v1/automation/metadata
GET /xsoar/public/v1/automation/metadata HTTP/1.1
Host: api-yourfqdn
Accept: */*
200
OK
[
{
"id": "ReadProcessesFileXDR",
"version": 50,
"name": "ReadProcessesFileXDR",
"type": "python",
"tags": [
"dynamic-section"
],
"contextKeys": [],
"comment": "Return a process list from the XDRIR integration.",
"enabled": true,
"system": true,
"detached": false,
"locked": false,
"user": "",
"dockerImage": "demisto/python3:3.10.13.83255",
"modified": "2024-01-12T21:36:30.371317155Z",
"scriptTarget": 0,
"arguments": null,
"runAs": "DBotWeakRole",
"roles": null,
"permitted": true,
"propagationLabels": null
},
{
"id": "QRadarPrintEvents",
"version": 79,
"name": "QRadarPrintEvents",
"type": "python",
"tags": [
"dynamic-section"
],
"contextKeys": [],
"comment": "This script prints the events fetched from the offense in a table format.",
"enabled": true,
"system": true,
"detached": false,
"locked": false,
"user": "",
"dockerImage": "demisto/python3:3.10.4.30607",
"modified": "2024-02-20T21:06:29.757778897Z",
"scriptTarget": 0,
"arguments": null,
"runAs": "DBotWeakRole",
"roles": [],
"permitted": true,
"propagationLabels": null
},
{
"id": "EntryWidgetCoATechniquesList",
"version": 52,
"name": "EntryWidgetCoATechniquesList",
"type": "python",
"tags": [
"dynamic-section"
],
"contextKeys": [],
"comment": "Entry widget that shows the number of techniques that were not yet handled by the CoA playbooks.",
"enabled": true,
"system": true,
"detached": false,
"locked": false,
"user": "",
"dockerImage": "demisto/python3:3.10.8.37233",
"modified": "2023-12-20T21:24:16.196888598Z",
"scriptTarget": 0,
"arguments": null,
"runAs": "DBotWeakRole",
"roles": null,
"permitted": true,
"propagationLabels": null
}
]Search scripts using a filter.
Body
automationScriptFilter is a general filter that fetches entities using a query string query using the Query value
ignoreWorkersbooleanOptional
Do not use workers mechanism while searching bleve
pageinteger · int64Optional
0-based page
querystringOptional
searchAfterstring[]Optional
Efficient next page, pass max sort value from previous page
searchAfterElasticstring[]Optional
Efficient next page, pass max ES sort value from previous page
searchBeforestring[]Optional
Efficient prev page, pass min sort value from next page
searchBeforeElasticstring[]Optional
Efficient prev page, pass min ES sort value from next page
sizeinteger · int64Optional
Size is limited to 1000, if not passed it defaults to 0, and no results will return
stripContextbooleanOptional
Responses
200
OK automationScriptResult
application/json
pythonEnabledbooleanOptional
suggestionsstring[]Optional
post/xsoar/public/v1/automation/search
POST /xsoar/public/v1/automation/search HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 390
{
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"ignoreWorkers": true,
"page": 1,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"stripContext": true
}200
OK automationScriptResult
{
"pythonEnabled": true,
"scripts": [
{
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"comment": "text",
"contextKeys": [
"text"
],
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"hidden": true,
"id": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"permitted": true,
"polling": true,
"propagationLabels": [
"text"
],
"roles": [
"text"
],
"runAs": "text",
"scriptTarget": 1,
"system": true,
"tags": [
"text"
],
"type": "text",
"user": "text",
"version": 1
}
],
"selectedScript": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"suggestions": [
"text"
]
}Create or update a script.
Header parameters
authorizationstringRequiredExample:
api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrx-xdr-auth-idstringRequiredExample:
api_key_id
2841Body
savePasswordbooleanOptional
To have this script password protected, set this to true and include the password value in the pswd field.
To leave this script without a password, set this to false and leave the value of the pswd field empty.
Responses
200
OK
application/json
pythonEnabledbooleanOptional
suggestionsstring[]Optional
post/xsoar/public/v1/automation
POST /xsoar/public/v1/automation HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 130
{
"script": {
"name": "hello_world_2",
"dockerImage": "demisto/python3:3.10.14.92207",
"propagationLabels": [
"all"
]
},
"savePassword": false
}200
OK
{
"pythonEnabled": true,
"scripts": [
{
"arguments": [
{
"auto": "text",
"default": true,
"defaultValue": "text",
"deprecated": true,
"description": "text",
"hidden": true,
"isArray": true,
"name": "text",
"predefined": [
"text"
],
"required": true,
"secret": true,
"type": "text"
}
],
"comment": "text",
"contextKeys": [
"text"
],
"dependsOn": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"deprecated": true,
"detached": true,
"dockerImage": "text",
"enabled": true,
"hidden": true,
"id": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"outputs": [
{
"contentPath": "text",
"contextPath": "text",
"description": {},
"type": "text"
}
],
"permitted": true,
"polling": true,
"propagationLabels": [
"text"
],
"roles": [
"text"
],
"runAs": "text",
"scriptTarget": 1,
"system": true,
"tags": [
"text"
],
"type": "text",
"user": "text",
"version": 1
}
],
"selectedScript": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"suggestions": [
"text"
]
}Get an existing script (automation) from a Cortex XSOAR tenant.
Path parameters
script_namestringRequired
Name of an existing script (automation)
Header parameters
authorizationstringRequiredExample:
api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrx-xdr-auth-idstringRequiredExample:
api_key_id
2841Body
objectOptional
Responses
200
OK
application/json
cacheVersnintegerOptional
commentstringOptional
commitMessagestringOptional
contextKeysobject[]Optional
definitionIdstringOptional
deprecatedbooleanOptional
detachedbooleanOptional
dockerImagestringOptional
enabledbooleanOptional
enginestringOptional
engineGroupstringOptional
fromServerVersionstringOptional
idstringOptional
importantnullOptional
itemVersionstringOptional
lockedbooleanOptional
modifiedstringOptional
namestringOptional
nativeImagenullOptional
outputsnullOptional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
permittedbooleanOptional
prevNamestringOptional
primaryTermintegerOptional
propagationLabelsobject[]Optional
pswdstringOptional
pswdProtectedbooleanOptional
rawTagsstring[]Optional
runAsstringOptional
runOncebooleanOptional
scriptstringOptional
scriptTargetintegerOptional
searchableNamestringOptional
sensitivebooleanOptional
sequenceNumberintegerOptional
shouldCommitbooleanOptional
sizeInBytesintegerOptional
subtypestringOptional
systembooleanOptional
tagsstring[]Optional
timeoutintegerOptional
toServerVersionstringOptional
typestringOptional
userstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versionintegerOptional
visualScriptstringOptional
post/xsoar/public/v1/automation/load/{script_name}
POST /xsoar/public/v1/automation/load/{script_name} HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 2
{}200
OK
{
"MainEngineInfo": {
"engine": "",
"engineGroup": ""
},
"arguments": [
{
"default": true,
"defaultValue": "${lastCompletedTaskEntries}",
"deprecated": false,
"description": "Entry IDs to add its output to Evidence Board",
"hidden": false,
"name": "entryIDs",
"required": true,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": true,
"description": "Description to add to Evidence Board",
"hidden": false,
"name": "desc",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "Description to add to Evidence Board",
"hidden": false,
"name": "description",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "Occurred time of the evidence (time format: 2008-01-02T15:04:05)",
"hidden": false,
"name": "occurred",
"required": false,
"secret": false,
"type": ""
},
{
"default": false,
"deprecated": false,
"description": "Evidence tags",
"hidden": false,
"name": "tags",
"required": false,
"secret": false,
"type": ""
}
],
"cacheVersn": 0,
"comment": "Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)\n",
"commitMessage": "",
"contextKeys": [],
"definitionId": "",
"deprecated": false,
"detached": false,
"dockerImage": "",
"enabled": true,
"engine": "",
"engineGroup": "",
"fromServerVersion": "5.0.0",
"id": "AddEvidence",
"important": null,
"itemVersion": "1.14.25",
"locked": false,
"modified": "2024-04-03T16:16:30.041688406Z",
"name": "AddEvidence",
"nativeImage": null,
"outputs": null,
"packID": "CommonScripts",
"packName": "Common Scripts",
"packPropagationLabels": [
"all"
],
"permitted": true,
"prevName": "AddEvidence",
"primaryTerm": 12,
"propagationLabels": [],
"pswd": "",
"pswdProtected": false,
"rawTags": [
"Utility"
],
"runAs": "DBotWeakRole",
"runOnce": false,
"script": "// pack version: 1.14.25\nif (!args.entryIDs) {\n throw 'Missing argument values for command AddEvidenceJS are : entryIDs';\n}\nvar entryIDs = args.entryIDs;\nvar entryTags = args.tags;\nvar desc = (args.description) ? args.description : args.desc ? args.desc : 'Evidence added by DBot';\nentryIDs = (Array.isArray(entryIDs)) ? entryIDs : [entryIDs];\nentryTags = (Array.isArray(entryTags)) ? entryTags.join(',') : entryTags;\n\nfor (var i=0;i<entryIDs.length;i++) {\n var entryID = entryIDs[i];\n entries = executeCommand('getEntry', {'id': entryID});\n if (isValidRes(entries)) {\n for (var j=0;j<entries.length;j++){\n var ent=entries[j];\n var obj = { 'id': entryID, 'description': desc};\n if (args.occurred) {\n obj.when = args.occurred;\n }\n if (entryTags) {\n obj.tags = entryTags;\n }\n var res = executeCommand('markAsEvidence', obj);\n if (!isValidRes(res)) {\n return res;\n }\n }\n } else {\n return entries;\n }\n\n}\n\nreturn \"Entry ID \" + entryIDs + \" added to evidence\";\n",
"scriptTarget": 0,
"searchableName": "AddEvidence",
"sensitive": false,
"sequenceNumber": 47514887,
"shouldCommit": false,
"sizeInBytes": 3230,
"subtype": "",
"system": true,
"tags": [
"Utility"
],
"timeout": 0,
"toServerVersion": "",
"type": "javascript",
"user": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"version": 192,
"visualScript": ""
}Last updated
Was this helpful?