Common Scripts

Checks whether a port was open on given host.

This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.

Searches Cortex XSOAR Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument.

Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument.

This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient.

Returns the length of the string passed as argument

This script calculates the CVSS Base Score, Temporal Score, and Environmental Score using either the CVSS 3.0 or CVSS 3.1 calculator according to https://www.first.org/cvss/ calculation documentation.

The script takes one or more domain names and checks whether they're in the Cortex XSOAR list defined in the InternalDomainsListName argument. By default, the InternalDomainsListName argument will use the Cortex XSOAR list called "InternalDomains".
The list can be customized by the user. It should contain the organization's internal domain names, separated by new lines. Subdomains are also supported in the list.
The results of the script are tagged with the "Internal_Domain_Check_Results" tag, so they can be displayed in the War Room entry sections in incident layouts.

This script searches for a value in a context path.

Deprecated. Use the MatchRegexV2 script instead.

Assign analyst to incident.
By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users).
Otherwise, the analyst will be picked according to the 'assignBy' arguments.
machine-learning: DBot will calculated and decide who is the best analyst for the job.
top-user: The user that is most commonly owns this type of incident
less-busy-user: The less busy analyst will be picked to be the incident owner.
online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users).
current: The user that executed the command.

Converts XML string to JSON format

Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps.

Use this script to avoid DB version errors when simultaneously running multiple linked incidents.

Gets hashes (MD5,SHA1,SHA256) from context.

Dumps a json from context key input, and returns a json object string result.

Generate a JSON file that can be downloaded and used to create the As-Built document for Cortex XSOAR.

Find the top malicious ratio indicators.
Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.

A context script for URL entities.

Check if indicators exist in the Threat Intel database.

Will create an array object in context from given string input

Creates a Grid table from items or key-value pairs.

Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file.

Try to get the hostname correlated with the input IP.

Find tables inside HTML and extract the contents into objects using the following logic:

• If table has a single column, just create an array of strings from the values
• If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value
• If table has a header row, create a table of objects where attribute names are the headers
• If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3…

Pretty-print data using Python's pprint library. This is useful for seeing the structure of incident and context data. Here's how to use it:

!PrettyPrint value=${incident}.

Searches Cortex XSOAR Indicators.

Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.

You can add additional fields from the indicators using the add_field_to_context argument.

Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)

Encode a file as base64 and store it in a Demisto list.

This script displays the execution results of the tab's buttons in an HTML table format.

Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
  https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations

Provides the severity of the CVE based on the CVSS score where available.

Joins values from two lists by index according to a given format.

Script will run the provided mathematical action on 2 provided values and produce a result.
The result can be stored on the context using the contextKey argument

Generate an as built document, as HTML, based on the running XSOAR instance. Requires an instance of the Demisto API integration configured.

Extract URLs redirected by security tools like Proofpoint.
Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html
Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com.

Convert an array to a nice table display. Usually, from the context.

Fetches the numbers of ads in the given url.

Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression.

This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex XSOAR 6.0.0).

Verify that the address is a valid IPv6 address.

Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.

Assigns the current Incident to the Cortex XSOAR user who clicked the button.

Will encode an input using Base64 format.

This script updates an indicator's grid field in Cortex XSOAR with provided row data. You can input the rows directly or extract them from the context.

Load the contents of a file into context.

Uses the ssh integration to grab the host server logs. This script is supported only on Cortex XSOAR on-prem (version 6.X).

This script resolves the original URL from a given shortened URL and places the resolved URL in the playbook context and output.

Display HTML in the War Room.

Converts a simple Array into a textual comma separated string.

Given a list of objects and a key found in each of those objects, return a unique list of values associated with that key. Returns error if the objects provided do not contain the key of interest.

Deprecated. Use DBotFindSimilarIncidents instead.

Finds similar incidents by common incident keys, labels, custom fields or context keys.
It's highly recommended to use incident keys if possible (e.g., "type" for the same incident type).
For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label).

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format.

Incident action button script to link or unlink Incidents from an Incident.

Decode MIME base64 headers.

Check if a given value is true. Will return 'no' otherwise

Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.

Verifies that an email address is valid and only returns the address if it is valid.

This dynamic automation parses the CVSS score of a CVE and presents it in the layout in color according to its score.

A context script for Email entities.

Recursively un-escapes JSON data if escaped JSON is found

A context script for IP entities.

Shows a bar chart of the number of Positive Detections out of overall detections.

Lists executed commands in War Room

Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.

This script finds similar files that can be related to each other by fuzzy hash (SSDeep).

Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly.
If an array is returned. the first value will be the decision making value.

Checks if one percentage is less than another
Returns less: if firstPercentage < secondPercentage
Returns more: if firstPercentage >= secondPercentage
Returns exception if one of the inputs is not a float

Remove escaping chars from IP
127[.]0[.]0[.]1 -> 127.0.0.1

Close the current investigation as duplicate to other investigation.

Generates random string.

Gets all email addresses in context, excluding ones given.

This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room.

Takes the comments of a given entry ID and stores them in the incident context, under a provided context key.
For accessing the last executed task's comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId input parameter.

Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it.

Compare two lists and put the differences in context.

Sends an email informing the user of an SLA breach. The email is sent to the user who is assigned to the incident. It includes the incident name, ID, name of the SLA field that was breached, duration of that SLA field, and the date and time when that SLA was started.
In order to run successfully, the script should be configured to trigger on SLA breach, through field edit mode.

Delete field from context.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant.

Schedule a command to run inside the war room at a future time (once or reoccurring)

After running DeleteContext, this script can repopulate all the file entries in the ${File} context key.

Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code.

Deprecated. Use the UnzipFile script instead. UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context.
supported types are:
7z (.7z), ACE (.ace), ALZIP (.alz), AR (.a), ARC (.arc), ARJ (.arj), BZIP2 (.bz2), CAB (.cab), compress (.Z), CPIO (.cpio), DEB (.deb), DMS (.dms), GZIP (.gz), LRZIP (.lrz), LZH (.lha, .lzh), LZIP (.lz), LZMA (.lzma), LZOP (.lzo), RPM (.rpm), RAR (.rar), RZIP (.rz), TAR (.tar), XZ (.xz), ZIP (.zip, .jar) and ZOO (.zoo)

A script to generate investigation summary report in an automated way
Can be used in post-processing flow as well.

Collect entries matching to the conditions in the war room.

Searches for string in a path in context. If path is null, string will be searched in full context.

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

Verify that the CIDRs are valid.

Check if a given value is true. Will return 'no' otherwise

Get the Server URL.

Get the string distance between inputString and compareString (compareString can be a comma-separated list) based on Levenshtein Distance algorithm.

Marks given incidents as related to current incident.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Deprecated. Use DBotPreProcessTextData instead.

Deprecated. Use the "PhishingDedupPreprocessingRule" script instead.
Find duplicate incidents candidates.
Using machine learning techniques with pre-defined data (can also use data from the local environment), this script takes into consideration different features such as: labels comparison, email labels (relevant for phishing), incident time difference and shared indicators, which can be customized by the arguments.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Get the string distance for the sender from our domain.

Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types.

Gets all currently enabled integration instances.

Returns a map entry with a marker on the given coordinates (lat,lng), or address (requires a configured GoogleMaps instance).

Compares a single timestamp to a list of timestamps.

Deprecated. Use ParseEmailFilesV2 instead." Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook.

The script calculates the average DBot score for each indicator in the context.

Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument.
Sets a value into the context with the given context key. Doesn't append by default.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Changes the remediation SLA once a change in incident severity occurs.
This is done automatically and the changes can be configured to your needs.

Returns yes if the IP is in one of the ranges provided, returns no otherwise.

Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).

Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply.

Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example:
!GridFieldSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" gridfiled="gridfield".

Verifies if the given input contains valid IP addresses (IPv4 or IPv6).

Converts a date from a different timezone to UTC timezone.

This automation calculates the similarity ratio between every string in 2 different arrays and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common).

Parses a YAML string into context.

Parses a list by header and value.

Mark entries as notes if they are tagged with given tag.

Runs the polling command repeatedly, completes a blocking manual task when polling is done.

This script is designed to analyze a PFX (Personal Information Exchange) file for various suspicious or noteworthy characteristics from a security perspective.

Called by the GenericPolling playbook, schedules the polling task.

Calculate the time difference, in minutes.

Extract regular text from the given HTML.

Set a value in context under the key you entered.

Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF.

Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room.

Returns a string with all matches of a regex pattern groups replaced by a replacement.

Generate report summaries for the passed incidents.

Deprecated. Use FileCreateAndUploadV2 instead. Will create a file (using the given data input or entry ID) and upload it to current investigation war room.

List the redirects for a given URL.

Returns 'yes' if integration brand is available. Otherwise returns 'no'.

Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution.

Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. This script is based on the parse-emails XSOAR python package, check the script documentation for more info.

Encodes an input to Base64 format.

Extracts domains and FQDNs from URLs and emails.

Checks if the Docker container running this script has been hardened according to the recommended settings at:

• For Docker hardening guide (Cortex XSOAR 6.13) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide
• For Docker hardening guide (Cortex XSOAR 8 Cloud) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Docker-hardening-guide
• For Docker hardening guide (Cortex XSOAR 8.7 On-prem) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Docker-hardening-guide.

Prints text to war room (Markdown supported)

Checks if the supplied URLs are in the specified domains.

Removes a key in key/value store backed by an XSOAR list.

This script allows sending an HTML email, using a template stored as a list item under Lists:

• Cortex XSIAM: Settings -> Configurations -> Lists.
• Cortex XSOAR: Settings -> Lists.
  Placeholders are marked in DT format (i.e. ${incident.id} for incident ID).
  Available placeholders for example:
• ${incident.labels.Email/from}
• ${incident.name}
• ${object.value}
  See incident Context Data menu for available placeholders

Note: Sending emails require an active Mail Sender integration instance.

Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet.

Parse RDP bitmap cache data into a single collage image file.

This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.

This script pre-processes (resizes, sharpens, and grayscales) an image file from context, given an entry_id.

Prints an error entry with a given message.

Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix.

This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of random length including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class.

The min_* values all default to 0. This means that if the command is executed in this way:
!GeneratePassword max_lcase=10
It is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches.

The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics.

Converts HTML to Markdown.

Set a value built by a template in context under the key you entered.

Copy all entries marked as notes from current incident to another incident.

Zip a file and upload to war room.

This script allows disabling a specified user using one or more of the following integrations: SailPointIdentityIQ, ActiveDirectoryQuery, Okta, MicrosoftGraphUser, and IAM.

Strips, unquotes and unescapes URLs. If the URL is a Proofpoint or ATP URL, extracts its redirect URL. If more than one URL is passed to the formatter, the separator must be a pipe ("|").

Extract indicators from a text-based file.
Indicators that can be extracted:

• IP
• Domain
• URL
• File Hash
• Email Address

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Map the given values to the translated values. If given values: a,b,c, and translated: 1,2,3, then the input will return 1.

Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

DNS lookup utility to provide 'A' and 'PTR' record.

Uses the Core REST API integration to query the server audit trail logs, and return back a CSV or JSON file.

Replaces regex match/es in string.
Returns the string after replace was preformed.

Set indicator reputation to "suspicious" when malicious ratio is above threshold.
Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.

A wrapper script for the executeCommandAt command to be used in playbooks or the war-room.

Expose the incident owner into IncidentOwner context key

Export given array to csv file.

The script takes one or more IP addresses and checks whether they're in the private IP ranges defined in the PrivateIPsListName argument. By default, the PrivateIPsListName argument will use the Cortex XSOAR list called "PrivateIPs".
The list can be modified, and by default uses the ranges defined by the Internet Assigned Numbers Authority (IANA). The following are the default CIDR ranges for private IPv4 addresses:

• 10.0.0.0/8 (range: 10.0.0.0 to 10.255.255.255)
• 172.16.0.0/12 (range: 172.16.0.0 to 172.31.255.255)
• 192.168.0.0/16 (range: 192.168.0.0 to 192.168.255.255)
  In addition to ranges, it's also possible to add specific IP addresses to the list. You may also tag IPs or IP ranges by adding a comma after the IP or range, and then adding the tag that you want to tag the corresponding IP indicators with.

Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft.

Adds/Replaces a key in key/value store backed by an XSOAR list.

Add DBot score to context for indicators with custom vendor, score, reliability, and type.

Generates the URL for a Data Collection Task into Context. Can be used to get the url for tasks send via Email, Slack, or even if you select "By Task Only".

To generate links for specific users, add an array of users in the users argument.

Count an array size

Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.

compares two JSON files and returns their differences, such as added, removed, or changed fields, in a structured format.

Stops the "Time To Assign" timer if the owner of the incident was changed.

This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL.
This script is a field-display script, so it needs to be configured as such, when editing the incident field that will be used to display the indicators.

Converts a file from one format to a different format by using the convert-to function of Libre Office. For a list of supported input/output formats see: https://wiki.openoffice.org/wiki/Framework/Article/Filter/FilterList_OOo_3_0

Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm.

Take a list of devices and pull a specific file (given by path) from each using SCP.

Takes UTC and converts it to the specified timezone. Format must match the UTC date's format and output will be the same format. Can use in conjunction with ConvertDateToString.

Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.

Compares the labels of two incidents. Returns the labels that are unique to each incident.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Check if list exist in demisto lists.

Populates critical assets in a grid field that has the section headers "Asset Type" and "Asset Name".

Exports the Context for the current Incident to a JSON file in the war room.

Verify URL SSL certificate.

Returns wether a PDF is both valid and encrypted.

Get the overall score for the indicator as calculated by DBot.

Searches for string in context and returns context path, returns null if not found.

List all Docker images that are in use by the installed integrations and automations.

Used to extract indicators from Word files (DOC, DOCX).
The script does not extract data from macros (e.g., embedded code).

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Returns a dict of all incident fields that exist in the system.

Returns the license ID.

Gather information regarding CIDR -
1. Broadcast_address
2. CIDR
3. First_address
4. Last address
5. Max prefix len
6. Num addresses
7. Private
8. Version.

Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system)

Converts XML file entry to JSON format

Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts.

Fill the current time in a custom incident field.

Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.x. This automation creates indicators and adds an indicator's relationships if available.

Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system.

Utility script to use in playbooks - returns "yes" if the input is non-empty.

Sends a HTTP request with advanced capabilities.

Gets docker image latest tag. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with the docker image latest tag if all is good, otherwise will return an error.

Copy a context key to an incident field of multiple incidents, based on an incident query.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Execute a command on a remote machine (without installing a D2 agent)

Extracts hyperlinks from office files. Supported file types are: xlsx, docx, pptx.

This is only an example script, to showcase how to use and write JavaScript scripts

Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Gets a value from the specified incident's context.

Sets a custom incident field with current date.

Checks whether the PDF file is encrypted.

Show all scheduled entries for specific incident.

This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context.

Finds which integrations implement a specific Demisto command. The results will be returned as comma-separated values (CSV). The "Core REST API" integration must first be enabled.

Show indicator geo location on map.

Edit the server configuration (under settings/troubleshooting). You can either add a new configuration or update and remove an existing one.

Gets all IP addresses in context, excluding ones given.

Deprecated. Use PCAPMinerV2 instead. PCAPMiner is a tool to parse PCAP files and will return things like extracted files that are found, HTTP flows, and a variety of other information. It is uses a docker instance located on docker hub trorabaugh/dempcap:1.0. To use simply upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry id click on the link on the top right hand corner of a file attachment.

Loads a JSON file from the war room to context.

Extracts FQDNs from URLs and emails.

This button will generate summary 'Case Report' template for a given Incident.

Deprecated. No available replacement. Search for a binary on an endpoint using Carbon Black

Uses the ssh integration to grab the host server logs. This script is supported only on Cortex XSOAR on-prem (version 6.X).

Set multiple keys/values to the context.

A context script for hash entities.

Add into the incident's context the system internal DBot score for the input indicator.

Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents.

Generates a random UUID (UUID 4).

Display HTML with embedded images.

Script to convert a War Room output JSON File to a CSV file.

Ask a user a question via email and process the reply directly into the investigation.

Get the error(s) associated with a given entry/entries. Use ${lastCompletedTaskEntries} to check the previous task entries. The automation will return an array of the error contents from those entries.

Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist.

Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error.

Optionally increases the incident severity to the new value if it is greater than the existing severity.

Sends http request. Returns the response as json.

Extract fields from a certificate file and return the standard context.

Convert country name to country code or country code to country name.
Only one of 'country_code' or 'country_name' can be provided.
Example:
Input: { "country_code": "US" }
Output: { "United States" }
Another Example:
Input: { "country_name": "United States" }
Output: { "US" }.

Load a PDF file's content and metadata into context. Supports extraction of hashes, urls, and emails when available.

Returns DNS details for a domain.

The script is for use with GenericPolling, which checks the completion condition. It uses a DT to retrieve a value from the context data and evaluates it using another DT.

Pretty-print the contents of the playbook context.

Loads a json from string input, and returns a json object result.

A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators.
Note: You can use this script in an incident Layout button to allow tags to be added to indicators through the incident.

Return indicators appears in resolved incidents, and resolved incident ids.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Retrieves the current date and time.

Indicates whether a given value is a member of given array

Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII).

Content packs installer from marketplace.

This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:

• 0-25: Low Risk
• 26-50: Medium Risk
• 51-90: High Risk
• 91-100: Critical Risk

The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.

This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value.

Convert a JSON War Room output via EntryID to a CSV file.

Return the Demisto server version.

Converts Base64 file in a list to a binary file and upload to warroom.

Returns integration instances configured in Cortex XSOAR. You can filter by instance status and/or brand name (vendor).

This script is only meant to be used to disable the Enrich Excluded button in an indicator. It should not be used otherwise.

Shows a bar chart of the number of incident the 'To' and 'From' email addresses.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Extract Domain(s) from URL(s) and/or Email(s).

Converts a given array to an HTML table

Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.

Display the mapped fields in a dynamic-section.

This stops the scheduled task whose ID is given in the taskID argument.

Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values.

Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances.

Checks if the email address is part of the internal domains.

Read image files metadata and provide Exif tags.

When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode.

The script downloads a Python library using PIP, archives it, and returns the file to the war room.

Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context.

Enrich and calculate the reputation of a certificate indicator.

Sends email to incident owner when selected field is triggered.

This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field.

The automation takes Excel file (entryID) as an input and parses its content to the war room and context.

Creating a hash of a given input, support sha1, sha256, sha512, md5 and blake. Wrapper for https://docs.python.org/3/library/hashlib.html.

Extracts regex data from the provided text. The script support groups and looping.

Extract Attack Pattern Threat Intel Object. After auto extract extracts the Attack Pattern IDs, this script is executed and extracts the value (name) of the Attack Pattern.

Returns the incident field names associated to the specified incident type.

Sleep for X seconds.

Send message to Demisto online users over Email, Slack, Mattermost or all.

Extract strings from a file with optional filter - similar to binutils strings command.

Mark entries as evidence if they are tagged with given tag.

Checks if one number(float) as bigger than the other(float)
Returns yes: if first > second
Returns no: if first <= second
Returns exception if one of the inputs is not a number

Publish entries to incident's context

Calculates the entropy for the given data.

This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values.

Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields.

This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain.

A context script for Domain entities.

Parses a CSV and looks for a specific value in a specific column, returning a dict of the entire matching row. If no column value is specified, the entire CSV is read into the context.

Language detection based on Google's language-detection.

This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container.

We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context.

Pings an IP or url address, to verify it's up. Note - On Cortex XSOAR 8 and Cortex XSIAM, the script can run only on a custom engine.

aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery.

" (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects." - GDPR Art. 33

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" - GDPR Art. 4

"‘main establishment’ means: as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;" - GDPR Art. 4

Is other PII data breached

The status of the media notification

Is unique identification number breached

Is financial information breached

Is account information breached

Is Medical Information breached

Is unique biometric data breached

"A data protection impact assessment (…) shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale. - GDPR Art. 35

Is health insurance breached

Is the DPO confirm the breach

"In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." - GDPR Art. 33

Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types.

Provides the severity of the CVE based on the CVSS score where available.

Verify that the address is a valid IPv6 address.

This button will generate summary 'Case Report' template for a given Incident.

This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.

Deprecated. Use FileCreateAndUploadV2 instead. Will create a file (using the given data input or entry ID) and upload it to current investigation war room.

Zip a file and upload to war room.

Indicates whether a given value is a member of given array

Encode a file as base64 and store it in a Demisto list.

Extracts FQDNs from URLs and emails.

This script displays the execution results of the tab's buttons in an HTML table format.

Encodes an input to Base64 format.

Checks if the supplied URLs are in the specified domains.

Find tables inside HTML and extract the contents into objects using the following logic:

• If table has a single column, just create an array of strings from the values
• If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value
• If table has a header row, create a table of objects where attribute names are the headers
• If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3…

Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error.

Optionally increases the incident severity to the new value if it is greater than the existing severity.

Optionally increases the alert severity to the new value if it is greater than the existing severity.

Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. This script is based on the parse-emails XSOAR python package, check the script documentation for more info.

Decode MIME base64 headers.

This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL.
This script is a field-display script, so it needs to be configured as such, when editing the incident field that will be used to display the indicators.

This script is used to display the indicators of an alert in an alert field of type Array. It can be used to select indicators from the alert in order to later perform some actions, like tagging the indicators for blocking via EDL.
This script is a field-display script, so it needs to be configured as such, when editing the alert field that will be used to display the indicators.

Searches Cortex Indicators.

Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict.

You can add additional fields from the indicators using the add_field_to_context argument.

This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex).

Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room.

This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of random length including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class.

The min_* values all default to 0. This means that if the command is executed in this way:
!GeneratePassword max_lcase=10
It is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches.

The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics.

This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:

• 0-25: Low Risk
• 26-50: Medium Risk
• 51-90: High Risk
• 91-100: Critical Risk

The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.

Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code.

Removes a key in key/value store backed by an XSOAR list.

Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.

The automation takes Excel file (entryID) as an input and parses its content to the war room and context.

This script searches for a value in a context path.

Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system)

Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system)

Returns the license ID.

Returns a dict of all incident fields that exist in the system.

Returns a dict of all alert fields that exist in the system.

Extract Domain(s) from URL(s) and/or Email(s).

Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist.

Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context.

Deprecated. Use the "PhishingDedupPreprocessingRule" script instead.
Find duplicate incidents candidates.
Using machine learning techniques with pre-defined data (can also use data from the local environment), this script takes into consideration different features such as: labels comparison, email labels (relevant for phishing), incident time difference and shared indicators, which can be customized by the arguments.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Deprecated. Use the UnzipFile script instead. UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context.
supported types are:
7z (.7z), ACE (.ace), ALZIP (.alz), AR (.a), ARC (.arc), ARJ (.arj), BZIP2 (.bz2), CAB (.cab), compress (.Z), CPIO (.cpio), DEB (.deb), DMS (.dms), GZIP (.gz), LRZIP (.lrz), LZH (.lha, .lzh), LZIP (.lz), LZMA (.lzma), LZOP (.lzo), RPM (.rpm), RAR (.rar), RZIP (.rz), TAR (.tar), XZ (.xz), ZIP (.zip, .jar) and ZOO (.zoo)

Copy all entries marked as notes from current incident to another incident.

Copy all entries marked as notes from current alert to another alert.

Strips, unquotes and unescapes URLs. If the URL is a Proofpoint or ATP URL, extracts its redirect URL. If more than one URL is passed to the formatter, the separator must be a pipe ("|").

Publish entries to incident's context

Export given array to csv file.

Convert a JSON War Room output via EntryID to a CSV file.

A wrapper script for the executeCommandAt command to be used in playbooks or the war-room.

Load the contents of a file into context.

Parse RDP bitmap cache data into a single collage image file.

A context script for Email entities.

This script is designed to analyze a PFX (Personal Information Exchange) file for various suspicious or noteworthy characteristics from a security perspective.

Replaces regex match/es in string.
Returns the string after replace was preformed.

Will create an array object in context from given string input

Finds which integrations implement a specific Demisto command. The results will be returned as comma-separated values (CSV). The "Core REST API" integration must first be enabled.

Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument.
Sets a value into the context with the given context key. Doesn't append by default.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Works the same as the 'Set' command, but can work across alerts by specifying 'id' as an argument.
Sets a value into the context with the given context key. Doesn't append by default.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Copy a context key to an incident field of multiple incidents, based on an incident query.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

List all Docker images that are in use by the installed integrations and automations.

Gets all IP addresses in context, excluding ones given.

The script is for use with GenericPolling, which checks the completion condition. It uses a DT to retrieve a value from the context data and evaluates it using another DT.

Verify URL SSL certificate.

Utility script to use in playbooks - returns "yes" if the input is non-empty.

This is only an example script, to showcase how to use and write JavaScript scripts

Gets hashes (MD5,SHA1,SHA256) from context.

Script to convert a War Room output JSON File to a CSV file.

Assign analyst to incident.
Note: the script should be executed from within an alert.
By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users).
Otherwise, the analyst will be picked according to the 'assignBy' arguments.
machine-learning: DBot will calculated and decide who is the best analyst for the job.
top-user: The user that is most commonly owns this type of incident
less-busy-user: The less busy analyst will be picked to be the incident owner.
online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users).
current: The user that executed the command.

Returns 'yes' if integration brand is available. Otherwise returns 'no'.

Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system.

Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix.

A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators.
Note: You can use this script in an incident Layout button to allow tags to be added to indicators through the incident.

Runs the polling command repeatedly, completes a blocking manual task when polling is done.

Prints a value to the parent incident's war-room of the current alert.

Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances.

Send message to Demisto online users over Email, Slack, Mattermost or all.

Prints a value to the specified incident's war-room.

Returns the incident field names associated to the specified incident type.

Returns the alert field names associated to the specified alert type.

Converts HTML to Markdown.

Searches for string in a path in context. If path is null, string will be searched in full context.

Sleep for X seconds.

Returns integration instances configured in Cortex. You can filter by instance status and/or brand name (vendor).

Gets all email addresses in context, excluding ones given.

This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field.

Deprecated. Use the MatchRegexV2 script instead.

Sets a custom incident field with current date.

Creating a hash of a given input, support sha1, sha256, sha512, md5 and blake. Wrapper for https://docs.python.org/3/library/hashlib.html.

A context script for Domain entities.

Calculate the time difference, in minutes.

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

Deprecated. Use PCAPMinerV2 instead. PCAPMiner is a tool to parse PCAP files and will return things like extracted files that are found, HTTP flows, and a variety of other information. It is uses a docker instance located on docker hub trorabaugh/dempcap:1.0. To use simply upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry id click on the link on the top right hand corner of a file attachment.

This script is only meant to be used to disable the Enrich Excluded button in an indicator. It should not be used otherwise.

Parses a YAML string into context.

Expose the incident owner into IncidentOwner context key

Expose the alert owner into AlertOwner context key

This script resolves the original URL from a given shortened URL and places the resolved URL in the playbook context and output.

Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly.
If an array is returned. the first value will be the decision making value.

Take a list of devices and pull a specific file (given by path) from each using SCP.

Script will run the provided mathematical action on 2 provided values and produce a result.
The result can be stored on the context using the contextKey argument

Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it.

Set a value built by a template in context under the key you entered.

Deprecated. Use ParseEmailFilesV2 instead." Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook.

Verifies that an email address is valid and only returns the address if it is valid.

Takes UTC and converts it to the specified timezone. Format must match the UTC date's format and output will be the same format. Can use in conjunction with ConvertDateToString.

Prints text to war room (Markdown supported)

Execute a command on a remote machine (without installing a D2 agent)

Deprecated. Use DBotFindSimilarIncidents instead.

Finds similar incidents by common incident keys, labels, custom fields or context keys.
It's highly recommended to use incident keys if possible (e.g., "type" for the same incident type).
For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label).

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Deprecated. Use DBotFindSimilarAlerts instead.

Finds similar alerts by common alert keys, labels, custom fields or context keys.
It's highly recommended to use alert keys if possible (e.g., "type" for the same alert type).
For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label).

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Check if indicators exist in the Threat Intel database.

Get the string distance between inputString and compareString (compareString can be a comma-separated list) based on Levenshtein Distance algorithm.

A script to generate investigation summary report in an automated way
Can be used in post-processing flow as well.

Gather information regarding CIDR -
1. Broadcast_address
2. CIDR
3. First_address
4. Last address
5. Max prefix len
6. Num addresses
7. Private
8. Version.

Used to extract indicators from Word files (DOC, DOCX).
The script does not extract data from macros (e.g., embedded code).

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Converts a given array to an HTML table

Extract Attack Pattern Threat Intel Object. After auto extract extracts the Attack Pattern IDs, this script is executed and extracts the value (name) of the Attack Pattern.

Returns a map entry with a marker on the given coordinates (lat,lng), or address (requires a configured GoogleMaps instance).

Collect entries matching to the conditions in the war room.

Verifies if the given input contains valid IP addresses (IPv4 or IPv6).

Read image files metadata and provide Exif tags.

Try to get the hostname correlated with the input IP.

Schedule a command to run inside the war room at a future time (once or reoccurring)

Calculates the entropy for the given data.

Generate an as built document, as HTML, based on the running XSOAR instance. Requires an instance of the Demisto API integration configured.

Exports the Context for the current Incident to a JSON file in the war room.

A context script for IP entities.

Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.

Gets all currently enabled integration instances.

Convert an array to a nice table display. Usually, from the context.

Set indicator reputation to "suspicious" when malicious ratio is above threshold.
Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.

Display HTML with embedded images.

Lists executed commands in War Room

Display the mapped fields in a dynamic-section.

Returns the length of the string passed as argument

Extract regular text from the given HTML.

Assigns the current Incident to the Cortex user who clicked the button.

Checks if one percentage is less than another
Returns less: if firstPercentage < secondPercentage
Returns more: if firstPercentage >= secondPercentage
Returns exception if one of the inputs is not a float

The script downloads a Python library using PIP, archives it, and returns the file to the war room.

Parses a list by header and value.

Edit the server configuration (under settings/troubleshooting). You can either add a new configuration or update and remove an existing one.

Compare two lists and put the differences in context.

This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context.

Mark entries as notes if they are tagged with given tag.

A context script for hash entities.

This dynamic automation parses the CVSS score of a CVE and presents it in the layout in color according to its score.

Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression.

Compares a single timestamp to a list of timestamps.

Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Permission-Management

Searches Demisto alerts. A summarized version of this scrips is available with the summarizedversion argument.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Permission-Management

Remove escaping chars from IP
127[.]0[.]0[.]1 -> 127.0.0.1

Adds/Replaces a key in key/value store backed by an XSOAR list.

Converts Base64 file in a list to a binary file and upload to warroom.

Pretty-print the contents of the playbook context.

Add DBot score to context for indicators with custom vendor, score, reliability, and type.

Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant.

After running DeleteContext, this script can repopulate all the file entries in the ${File} context key.

Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents.

Uses the Core REST API integration to query the server audit trail logs, and return back a CSV or JSON file.

List the redirects for a given URL.

Takes the comments of a given entry ID and stores them in the incident context, under a provided context key.
For accessing the last executed task's comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId input parameter.

Extract URLs redirected by security tools like Proofpoint.
Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html
Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com.

Get the string distance for the sender from our domain.

Compares the labels of two incidents. Returns the labels that are unique to each incident.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Compares the labels of two alerts. Returns the labels that are unique to each alert.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution.

Sends a HTTP request with advanced capabilities.

Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.

Prints an error entry with a given message.

Deprecated. Use DBotPreProcessTextData instead.

Generates random string.

Deprecated. No available replacement. Search for a binary on an endpoint using Carbon Black

Count an array size

Content packs installer from marketplace.

Generates a random UUID (UUID 4).

Parses a CSV and looks for a specific value in a specific column, returning a dict of the entire matching row. If no column value is specified, the entire CSV is read into the context.

Will encode an input using Base64 format.

Sends http request. Returns the response as json.

Retrieves the current date and time.

This script calculates the CVSS Base Score, Temporal Score, and Environmental Score using either the CVSS 3.0 or CVSS 3.1 calculator according to https://www.first.org/cvss/ calculation documentation.

Find the top malicious ratio indicators.
Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.

Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply.

Returns yes if the IP is in one of the ranges provided, returns no otherwise.

Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII).

Delete field from context.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Extract indicators from a text-based file.
Indicators that can be extracted:

• IP
• Domain
• URL
• File Hash
• Email Address

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

This script allows disabling a specified user using one or more of the following integrations: SailPointIdentityIQ, ActiveDirectoryQuery, Okta, MicrosoftGraphUser, and IAM.

Enrich and calculate the reputation of a certificate indicator.

Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.

This script updates an indicator's grid field in Cortex with provided row data. You can input the rows directly or extract them from the context.

Return indicators appears in resolved incidents, and resolved incident ids.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Converts XML string to JSON format

DNS lookup utility to provide 'A' and 'PTR' record.

Extract fields from a certificate file and return the standard context.

This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.

Display HTML in the War Room.

Gets a value from the specified incident's context.

Gets a value from the specified alert's context.

Check if list exist in demisto lists.

Convert country name to country code or country code to country name.
Only one of 'country_code' or 'country_name' can be provided.
Example:
Input: { "country_code": "US" }
Output: { "United States" }
Another Example:
Input: { "country_name": "United States" }
Output: { "US" }.

Sends email to incident owner when selected field is triggered.

The script calculates the average DBot score for each indicator in the context.

Searches Cortex Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument.

Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument.

This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient.

Searches Cortex Alerts and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument.

Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument.

This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchAlertsV2 from the Common Scripts pack, but more efficient.

Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format.

This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain.

Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.

Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).

Checks if the email address is part of the internal domains.

Called by the GenericPolling playbook, schedules the polling task.

Dumps a json from context key input, and returns a json object string result.

Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields.

This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value.

Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet.

This script finds similar files that can be related to each other by fuzzy hash (SSDeep).

This script pre-processes (resizes, sharpens, and grayscales) an image file from context, given an entry_id.

This script allows sending an HTML email, using a template stored as a list item under Lists:

• Cortex XSIAM: Settings -> Configurations -> Lists.
• Cortex: Settings -> Lists.
  Placeholders are marked in DT format (i.e. ${incident.id} for incident ID).
  Available placeholders for example:
• ${incident.labels.Email/from}
• ${incident.name}
• ${object.value}
  See incident Context Data menu for available placeholders

Note: Sending emails require an active Mail Sender integration instance.

Pings an IP or url address, to verify it's up. Note - On Cortex and Cortex XSIAM, the script can run only on a custom engine.

Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.

Set a value in context under the key you entered.

Check if a given value is true. Will return 'no' otherwise

Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps.

Mark entries as evidence if they are tagged with given tag.

Pretty-print data using Python's pprint library. This is useful for seeing the structure of incident and context data. Here's how to use it:

!PrettyPrint value=${incident}.

Set multiple keys/values to the context.

Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file.

Add into the incident's context the system internal DBot score for the input indicator.

Checks whether the PDF file is encrypted.

Extracts regex data from the provided text. The script support groups and looping.

aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery.

Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)

Converts XML file entry to JSON format

Searches for string in context and returns context path, returns null if not found.

Loads a json from string input, and returns a json object result.

Checks whether a port was open on given host.

This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container.

We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context.

Extracts hyperlinks from office files. Supported file types are: xlsx, docx, pptx.

Map the given values to the translated values. If given values: a,b,c, and translated: 1,2,3, then the input will return 1.

Creates a Grid table from items or key-value pairs.

Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Show indicator geo location on map.

This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values.

Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF.

Get the Server URL.

A context script for URL entities.

Close the current investigation as duplicate to other investigation.

Shows a bar chart of the number of Positive Detections out of overall detections.

Fetches the numbers of ads in the given url.

Given a list of objects and a key found in each of those objects, return a unique list of values associated with that key. Returns error if the objects provided do not contain the key of interest.

compares two JSON files and returns their differences, such as added, removed, or changed fields, in a structured format.

Returns wether a PDF is both valid and encrypted.

Show all scheduled entries for specific incident.

Language detection based on Google's language-detection.

Loads a JSON file from the war room to context.

Recursively un-escapes JSON data if escaped JSON is found

Get the overall score for the indicator as calculated by DBot.

Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example:
!GridFieldSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" gridfiled="gridfield".

Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft.

Prints a value to the specified alert's war-room. The alert must be in status "Under Investigation".

Check if a given value is true. Will return 'no' otherwise

Converts a file from one format to a different format by using the convert-to function of Libre Office. For a list of supported input/output formats see: https://wiki.openoffice.org/wiki/Framework/Article/Filter/FilterList_OOo_3_0

This automation calculates the similarity ratio between every string in 2 different arrays and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common).

Returns DNS details for a domain.

Converts a simple Array into a textual comma separated string.

Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.x. This automation creates indicators and adds an indicator's relationships if available.

Generates the URL for a Data Collection Task into Context. Can be used to get the url for tasks send via Email, Slack, or even if you select "By Task Only".

To generate links for specific users, add an array of users in the users argument.

This stops the scheduled task whose ID is given in the taskID argument.

Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Converts a date from a different timezone to UTC timezone.

Checks if the Docker container running this script has been hardened according to the recommended settings at:

• For Docker hardening guide (Cortex XSOAR 6.13) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide
• For Docker hardening guide (Cortex XSOAR 8 Cloud) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Docker-hardening-guide
• For Docker hardening guide (Cortex XSOAR 8.7 On-prem) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Docker-hardening-guide.

Load a PDF file's content and metadata into context. Supports extraction of hashes, urls, and emails when available.

Extract strings from a file with optional filter - similar to binutils strings command.

Populates critical assets in a grid field that has the section headers "Asset Type" and "Asset Name".

Fill the current time in a custom incident field.

Generate report summaries for the passed incidents.

Shows a bar chart of the number of incident the 'To' and 'From' email addresses.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Lookup alerts with specified indicator. Use currentAlertId to omit the existing alert from output.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:

• For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations
• For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
• For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Get the error(s) associated with a given entry/entries. Use ${lastCompletedTaskEntries} to check the previous task entries. The automation will return an array of the error contents from those entries.

Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm.

Joins values from two lists by index according to a given format.

Verify that the CIDRs are valid.

Ask a user a question via email and process the reply directly into the investigation.

This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room.

This automation uses the Core REST API Integration to batch export Alerts to CSV and return the resulting CSV file to the war room.

Returns a string with all matches of a regex pattern groups replaced by a replacement.

Checks if one number(float) as bigger than the other(float)
Returns yes: if first > second
Returns no: if first <= second
Returns exception if one of the inputs is not a number

When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode.

When you apply this script to an alert field, that alert field is hidden for new alerts, and it displays in edit mode.

Gets docker image latest tag. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with the docker image latest tag if all is good, otherwise will return an error.

Extracts domains and FQDNs from URLs and emails.

Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts.

Data output script for populating dashboard pie graph widget with the percentage of alerts closed by DBot vs. alerts closed by analysts.

Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values.

Is Medical Information breached

"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" - GDPR Art. 4

Is unique identification number breached

Is account information breached

Is health insurance breached

Is the DPO confirm the breach

"A data protection impact assessment (…) shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale. - GDPR Art. 35

Is financial information breached

The status of the media notification

Is unique biometric data breached

"In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." - GDPR Art. 33

Is other PII data breached

"‘main establishment’ means: as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;" - GDPR Art. 4

" (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects." - GDPR Art. 33