Base

Name	Description
CheckDockerImageAvailable	Check if a docker image is available for performing docker pull. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with 'ok' if all is good otherwise will return an error.
CommonServer	Common code that will be merged into each server script when it runs.
CommonServerPowerShell	Common code that will be merged into each PowerShell script/integration when it runs.
DrawRelatedIncidentsCanvas	Draw incidents and indicators on the canvas to map and visualize their connections.
StixParser	Parse STIX files to Cortex XSOAR indicators by clicking the Upload STIX File button.
GetIndicatorsByQuery	Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.
DBotFindSimilarIncidentsByIndicators	Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
DBotTrainClustering	This script helps organizes and groups incidents based on their similarities using clustering algorithms. Clustering is a technique used to group data points (in this case, incidents) that are similar to each other into clusters. Used to automatically categorize a large number of incidents into meaningful groups.
GetMLModelEvaluation	Finds a threshold for ML model, and performs an evaluation based on it.
SearchIndicatorRelationships	This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
DBotPredictPhishingWords	Predict text label using a pre-trained machine learning phishing model, and get the most important words used in the classification decision.
WordTokenizerNLP	Deprecated. Use DBotPreProcessTextData instead.
DBotSuggestClassifierMapping	Deprecated. No available replacement. Suggests a classifier mapping based on an advanced name matching algorithm.
SaneDocReports	Parse Sane-json-reports and export them as docx files (used internally).
SanePdfReports	Parse Sane-json-reports and export them as pdf files (used internally).
DBotShowClusteringModelInfo	Show clustering model information - model summary and incidents in specific cluster.
HighlightWords	Highlight words inside a given text.
DBotBuildPhishingClassifier	Create a phishing classifier using machine learning technique, based on email content.
ValidateContent	Runs validation and linting using the Demisto SDK on content items, such as integrations, automations and content packs. This automation script is used as part of the content validation that runs as part of the contribution flow.
DBotTrainTextClassifierV2	Train a machine learning text classifier.
CreateIndicatorRelationship	This automation creates a relationship between indicator objects.
CommonServerPython	Common code that will be merged into each server script when it runs.
DBotPreProcessTextData	Pre-process text data for the machine learning text classifier.
DBotMLFetchData	Deprecated. No available replacement. Collect telemetry data from the environment.
GetIncidentsByQuery	Gets a list of incident objects and the associated incident outputs that match the specified query and filters. The results are returned in a structured data file. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
DBotFindSimilarIncidents	Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity. Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
DeleteIndicatorRelationships	This automation allows to delete a relationship between indicator objects based on the relationship id.
FindSimilarIncidentsByText	Deprecated. Use DBotFindSimilarIncidents instead. Find similar incidents by text comparison - the algorithm based on TF-IDF method. To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Name	Description
System Health

Name	Description
DBotMLFetchData	Deprecated. No available replacement. Collect telemetry data from the environment.
DBotTrainClustering	This script helps organizes and groups incidents based on their similarities using clustering algorithms. Clustering is a technique used to group data points (in this case, incidents) that are similar to each other into clusters. Used to automatically categorize a large number of incidents into meaningful groups.
CommonServerPowerShell	Common code that will be merged into each PowerShell script/integration when it runs.
DeleteIndicatorRelationships	This automation allows to delete a relationship between indicator objects based on the relationship id.
StixParser	Parse STIX files to Cortex indicators by clicking the Upload STIX File button.
DBotFindSimilarIncidents	Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity. Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
DBotFindSimilarAlerts	Finds past similar alerts based on alert fields' similarity. Includes an option to also display indicators similarity. Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
DBotPreProcessTextData	Pre-process text data for the machine learning text classifier.
SaneDocReports	Parse Sane-json-reports and export them as docx files (used internally).
GetIncidentsByQuery	Gets a list of incident objects and the associated incident outputs that match the specified query and filters. The results are returned in a structured data file. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetAlertsByQuery	Gets a list of alert objects and the associated alert outputs that match the specified query and filters. The results are returned in a structured data file. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
DBotFindSimilarIncidentsByIndicators	Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
DBotFindSimilarAlertsByIndicators	Finds similar alerts based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
WordTokenizerNLP	Deprecated. Use DBotPreProcessTextData instead.
GetMLModelEvaluation	Finds a threshold for ML model, and performs an evaluation based on it.
ValidateContent	Runs validation and linting using the Demisto SDK on content items, such as integrations, automations and content packs. This automation script is used as part of the content validation that runs as part of the contribution flow.
CommonServerPython	Common code that will be merged into each server script when it runs.
SearchIndicatorRelationships	This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
GetIndicatorsByQuery	Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.
DBotSuggestClassifierMapping	Deprecated. No available replacement. Suggests a classifier mapping based on an advanced name matching algorithm.
FindSimilarIncidentsByText	Deprecated. Use DBotFindSimilarIncidents instead. Find similar incidents by text comparison - the algorithm based on TF-IDF method. To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
FindSimilarAlertsByText	Deprecated. Use DBotFindSimilarAlerts instead. Find similar alerts by text comparison - the algorithm based on TF-IDF method. To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CommonServer	Common code that will be merged into each server script when it runs.
DBotBuildPhishingClassifier	Create a phishing classifier using machine learning technique, based on email content.
SanePdfReports	Parse Sane-json-reports and export them as pdf files (used internally).
HighlightWords	Highlight words inside a given text.
CreateIndicatorRelationship	This automation creates a relationship between indicator objects.
CheckDockerImageAvailable	Check if a docker image is available for performing docker pull. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with 'ok' if all is good otherwise will return an error.

Scripts

CommonServerPython

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).

CommonServerPowerShell

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).
Updated the Docker image to: demisto/powershell:7.5.0.9017890.

CommonServer

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).

Certification	Certified	Read more
Supported By	Cortex
Created	August 2, 2020
Last Release	October 12, 2026

Scripts

CheckDockerImageAvailable

Base

Scripts

CommonServerPython

Scripts

DBotFindSimilarIncidentsByIndicators

Scripts

CommonServerPython

Scripts

CommonServerPython

Scripts

CommonServerPython

Scripts

CommonServerPython

Scripts

DrawRelatedIncidentsCanvas

DBotFindSimilarIncidentsByIndicators

DBotFindSimilarIncidents

FindSimilarIncidentsByText

Base

Scripts

DBotPreProcessTextData

GetMLModelEvaluation

Scripts

SanePdfReports

Scripts

DBotFindSimilarIncidents

Scripts

DBotTrainClustering

GetMLModelEvaluation

SanePdfReports

Scripts

ValidateContent

Base

Base

Base

Scripts

DBotFindSimilarIncidents

Scripts

GetMLModelEvaluation

DBotPredictPhishingWords

GetIndicatorsByQuery

Base

Scripts

GetIndicatorsByQuery

Scripts

DrawRelatedIncidentsCanvas

DBotFindSimilarIncidents

DBotFindSimilarIncidentsByIndicators

FindSimilarIncidentsByText

Scripts

CheckDockerImageAvailable

Scripts

CommonServerPython

Base

Scripts

SearchIndicatorRelationships

DBotTrainTextClassifierV2

DrawRelatedIncidentsCanvas

DeleteIndicatorRelationships

CreateIndicatorRelationship

DBotFindSimilarIncidents

GetIncidentsByQuery

DBotBuildPhishingClassifier

DBotShowClusteringModelInfo

HighlightWords

Scripts

SanePdfReports

Base

Scripts

CommonServerPython

Scripts

DBotFindSimilarIncidents

Scripts

CommonServerPython

CommonServerPowerShell

CommonServer

Dashboards