Converts XML file entry to JSON format
Common Scripts
- Details
- Content
- Dependencies
- Version History
Frequently used scripts pack.
Name | Description |
---|---|
ConvertXmlFileToJson | |
ScheduleGenericPolling | Called by the GenericPolling playbook, schedules the polling task. |
CompareLists | Compare two lists and put the differences in context. |
CreateIndicatorsFromSTIX | Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.x. This automation creates indicators and adds an indicator's relationships if available. |
GenerateSummaryReports | Generate report summaries for the passed incidents. |
cveReputationV2 | Provides the severity of the CVE based on the CVSS score where available. |
NumberOfPhishingAttemptPerUser | Shows a bar chart of the number of incident the 'To' and 'From' email addresses. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
CalculateEntropy | Calculates the entropy for the given data. |
SetGridField | Creates a Grid table from items or key-value pairs. |
AddKeyToList | Adds/Replaces a key in key/value store backed by an XSOAR list. |
ServerLogs_docker | Uses the ssh integration to grab the host server logs. |
RunDockerCommand | This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container. We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context. |
ParseCSV | This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context. |
CopyContextToField | Copy a context key to an incident field of multiple incidents, based on an incident query. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
URLReputation | A context script for URL entities. |
CheckSenderDomainDistance | Get the string distance for the sender from our domain |
ExtractIndicatorsFromWordFile | Used to extract indicators from Word files (DOC, DOCX). This automation runs using the default Limited User role, unless you explicitly change the permissions. |
clear-user-session | This script clears user sessions across multiple integrations for a list of usernames. |
CommandLineAnalysis | This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:
The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors. |
get-user-data | This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context. |
ContextGetIps | Gets all IP addresses in context, excluding ones given. |
DBotClosedIncidentsPercentage | Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts. |
JSONFileToCSV | Script to convert a War Room output JSON File to a CSV file. |
ParseEmailFilesV2 | Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. This script is based on the parse-emails XSOAR python package, check the script documentation for more info. |
GetDockerImageLatestTag | Gets docker image latest tag. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with the docker image latest tag if all is good, otherwise will return an error. |
ExtractIndicatorsFromTextFile | Extract indicators from a text-based file.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
SetMultipleValues | Set multiple keys/values to the context. |
EmailDomainSquattingReputation | Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm. |
ReadQRCode | Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code. |
GetEnabledInstances | Gets all currently enabled integration instances. |
IsGreaterThan | Checks if one number(float) as bigger than the other(float) |
findIncidentsWithIndicator | Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
ContextContains | This script searches for a value in a context path. |
HTMLtoMD | Converts HTML to Markdown. |
SendEmailOnSLABreach | Sends an email informing the user of an SLA breach. The email is sent to the user who is assigned to the incident. It includes the incident name, ID, name of the SLA field that was breached, duration of that SLA field, and the date and time when that SLA was started. |
IPReputation | A context script for IP entities. |
GetStringsDistance | Get the string distance between inputString and compareString (compareString can be a comma-separated list) based on Levenshtein Distance algorithm. |
FeedRelatedIndicatorsWidget | Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant. |
SendMessageToOnlineUsers | Send message to Demisto online users over Email, Slack, Mattermost or all. |
ExportIncidentsToCSV | This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room. |
ExtractHTMLTables | Find tables inside HTML and extract the contents into objects using the following logic:
|
EditServerConfig | Edit the server configuration (under settings/troubleshooting). You can either add a new configuration or update and remove an existing one. |
cvss_color | This dynamic automation parses the CVSS score of a CVE and presents it in the layout in color according to its score. |
ExtractFQDNFromUrlAndEmail | Extracts FQDNs from URLs and emails. |
JsonUnescape | Recursively un-escapes JSON data if escaped JSON is found |
StringReplace | Replaces regex match/es in string. |
MatchRegex | Deprecated. Use the MatchRegexV2 script instead. |
MITRENameByID_Formatter | Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data). |
MathUtil | Script will run the provided mathematical action on 2 provided values and produce a result. |
VerdictResult | This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field. |
Set | Set a value in context under the key you entered. |
GenerateAsBuiltConfiguration | Generate a JSON file that can be downloaded and used to create the As-Built document for Cortex XSOAR. |
IsInternalHostName | Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix. |
MaliciousRatioReputation | Set indicator reputation to "suspicious" when malicious ratio is above threshold. |
ReadFile | Load the contents of a file into context. |
UnPackFile | Deprecated. Use the UnzipFile script instead. UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context. |
IPToHost | Try to get the hostname correlated with the input IP. |
AddDBotScoreToContext | Add DBot score to context for indicators with custom vendor, score, reliability, and type. |
ContainsCreditCardInfo | Check if a given value is true. Will return 'no' otherwise |
TimeStampCompare | Compares a single timestamp to a list of timestamps. |
GenerateSummaryReportButton | This button will generate summary 'Case Report' template for a given Incident |
StopTimeToAssignOnOwnerChange | Stops the "Time To Assign" timer if the owner of the incident was changed. |
ServerLogs | Uses the ssh integration to grab the host server logs. |
DeleteContext | Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
CEFParser | Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields. |
DomainReputation | A context script for Domain entities |
VerifyIPv6Indicator | Verify that the address is a valid IPv6 address. |
CheckFieldValue | This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. |
ExtractDomainAndFQDNFromUrlAndEmail | Extracts domains and FQDNs from URLs and emails. |
FindSimilarIncidents | Deprecated. Use DBotFindSimilarIncidents instead. Finds similar incidents by common incident keys, labels, custom fields or context keys. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
GetDuplicatesMlv2 | Deprecated. Use the "PhishingDedupPreprocessingRule" script instead. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
GenerateRandomString | Generates random string |
MarkAsNoteByTag | Mark entries as notes if they are tagged with given tag. |
DeduplicateValuesbyKey | Given a list of objects and a key found in each of those objects, return a unique list of values associated with that key. Returns error if the objects provided do not contain the key of interest. |
DBotAverageScore | The script calculates the average DBot score for each indicator in the context. |
AssignToMeButton | Assigns the current Incident to the Cortex XSOAR user who clicked the button |
UnEscapeURLs | Extract URLs redirected by security tools like Proofpoint. |
TopMaliciousRatioIndicators | Find the top malicious ratio indicators. |
RemoveKeyFromList | Removes a key in key/value store backed by an XSOAR list. |
LoadJSON | Loads a json from string input, and returns a json object result. |
CloseInvestigationAsDuplicate | Close the current investigation as duplicate to other investigation. |
LanguageDetect | Language detection based on Google's language-detection. |
StringLength | Returns the length of the string passed as argument |
ListUsedDockerImages | List all Docker images that are in use by the installed integrations and automations. |
SearchIncidentsV2 | Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
PCAPMiner | Deprecated. Use PCAPMinerV2 instead. PCAPMiner is a tool to parse PCAP files and will return things like extracted files that are found, HTTP flows, and a variety of other information. It is uses a docker instance located on docker hub trorabaugh/dempcap:1.0. To use simply upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry id click on the link on the top right hand corner of a file attachment. |
GetEntries | Collect entries matching to the conditions in the war room. |
Dig | DNS lookup utility to provide 'A' and 'PTR' record |
ZipStrings | Joins values from two lists by index according to a given format. |
IncidentAddSystem | Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system) |
ExportToXLSX | Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file. |
GenerateRandomUUID | Generates a random UUID (UUID 4). |
SearchIncidentsSummary | Searches Cortex XSOAR Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient. |
CreateEmailHtmlBody | This script allows sending an HTML email, using a template stored as a list item under Lists (Settings -> Advanced -> Lists).
Note: Sending emails require an active Mail Sender integration instance. |
RepopulateFiles | After running DeleteContext, this script can repopulate all the file entries in the ${File} context key |
FetchIndicatorsFromFile | Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types. |
IsIPPrivate | The script takes one or more IP addresses and checks whether they're in the private IP ranges defined in the PrivateIPsListName argument. By default, the PrivateIPsListName argument will use the Cortex XSOAR list called "PrivateIPs".
|
IsMaliciousIndicatorFound | Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found. |
ContextGetEmails | Gets all email addresses in context, excluding ones given. |
FormatURL | Strips, unquotes and unescapes URLs. If the URL is a Proofpoint or ATP URL, extracts its redirect URL. If more than one URL is passed to the formatter, the separator must be a pipe ("|"). |
GetErrorsFromEntry | Get the error(s) associated with a given entry/entries. Use ${lastCompletedTaskEntries} to check the previous task entries. The automation will return an array of the error contents from those entries. |
PrintErrorEntry | Prints an error entry with a given message. |
EmailAskUserResponse | Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply. |
DockerHardeningCheck | Checks if the Docker container running this script has been hardened according to the recommended settings at:
|
ZipFile | Zip a file and upload to war room. |
NotInContextVerification | Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution. |
IsValueInArray | Indicates whether a given value is a member of given array |
PopulateCriticalAssets | Populates critical assets in a grid field that has the section headers "Asset Type" and "Asset Name". |
PrintContext | Pretty-print the contents of the playbook context. |
ExifRead | Read image files metadata and provide Exif tags. |
FilterByList | Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist. |
ContextFilter | Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it. |
DownloadAndArchivePythonLibrary | The script downloads a Python library using PIP, archives it, and returns the file to the war room. |
ConvertXmlToJson | Converts XML string to JSON format |
ConvertTableToHTML | Converts a given array to an HTML table |
SCPPullFiles | Take a list of devices and pull a specific file (given by path) from each using SCP. |
GenericPollingScheduledTask | Runs the polling command repeatedly, completes a blocking manual task when polling is done. |
StixCreator | Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format. |
ParseEmailFiles | Deprecated. Use ParseEmailFilesV2 instead." Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. |
ChangeContext | Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values. |
GridFieldSetup | Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. Instead of a value you can enter |
RemoteExec | Execute a command on a remote machine (without installing a D2 agent) |
CheckContextValue | This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values. |
ShowOnMap | Returns a map entry with a marker on the given coordinates (lat,lng), or address (requires a configured GoogleMaps instance). |
MatchRegexV2 | Extracts regex data from the provided text. The script support groups and looping. |
ConvertCountryCodeCountryName | Convert country name to country code or country code to country name. |
IdentifyAttachedEmail | Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team. |
PrintRaw | Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression. |
LinkIncidentsButton | Incident action button script to link or unlink Incidents from an Incident |
ContentPackInstaller | Content packs installer from marketplace. |
IsTrue | Check if a given value is true. Will return 'no' otherwise |
Sleep | Sleep for X seconds. |
IsIPInRanges | Returns yes if the IP is in one of the ranges provided, returns no otherwise. |
Base64ListToFile | Converts Base64 file in a list to a binary file and upload to warroom |
GeneratePassword | This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of random length including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. The min_* values all default to 0. This means that if the command is executed in this way: The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics. |
StopScheduledTask | This stops the scheduled task whose ID is given in the taskID argument. |
AquatoneDiscoverV2 | aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery. |
IsolationAssetWrapper | This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex XSOAR 6.0.0). |
StringSimilarity | This automation calculates the similarity ratio between every string in 2 different arrays and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common). |
SetByIncidentId | Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
AssignAnalystToIncident | Assign analyst to incident. |
SetAndHandleEmpty | Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
DemistoVersion | Return the Demisto server version. |
CreateHash | Creating a hash of a given input, support sha1, sha256, sha512, md5 and blake. Wrapper for https://docs.python.org/3/library/hashlib.html. |
AddEvidence | Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments) |
AreValuesEqual | Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned. |
LinkIncidentsWithRetry | Use this script to avoid DB version errors when simultaneously running multiple linked incidents. |
GenerateAsBuilt | Generate an as built document, as HTML, based on the running XSOAR instance. Requires an instance of the Demisto API integration configured. |
CopyNotesToIncident | Copy all entries marked as notes from current incident to another incident. |
GetServerURL | Get the Server URL. |
ScheduleCommand | Schedule a command to run inside the war room at a future time (once or reoccurring) |
VerifyJSON | Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet. |
displayUtilitiesResults | This script displays the execution results of the tab's buttons in an HTML table format. |
MarkRelatedIncidents | Marks given incidents as related to current incident. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
PositiveDetectionsVSDetectionEngines | Shows a bar chart of the number of Positive Detections out of overall detections |
SetWithTemplate | Set a value built by a template in context under the key you entered. |
FileCreateAndUpload | Deprecated. Use FileCreateAndUploadV2 instead. Will create a file (using the given data input or entry ID) and upload it to current investigation war room. |
ParseYAML | Parses a YAML string into context |
http | Sends http request. Returns the response as json. |
CompareIncidentsLabels | Compares the labels of two incidents. Returns the labels that are unique to each incident. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
checkValue | Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly. |
ExampleJSScript | This is only an example script, to showcase how to use and write JavaScript scripts |
ExportAuditLogsToFile | Uses the Core REST API integration to query the server audit trail logs, and return back a CSV or JSON file. |
ExportContextToJSONFile | Exports the Context for the current Incident to a JSON file in the war room. |
URLNumberOfAds | Fetches the numbers of ads in the given url. |
GetDataCollectionLink | Generates the URL for a Data Collection Task into Context. Can be used to get the url for tasks send via Email, Slack, or even if you select "By Task Only". To generate links for specific users, add an array of users in the users argument. |
ExportToCSV | Export given array to csv file. |
SetTime | Fill the current time in a custom incident field |
displayMappedFields | Display the mapped fields in a dynamic-section. |
SSDeepSimilarity | This script finds similar files that can be related to each other by fuzzy hash (SSDeep). |
GetFieldsByIncidentType | Returns the incident field names associated to the specified incident type. |
CertificateReputation | Enrich and calculate the reputation of a certificate indicator. |
ReplaceMatchGroup | Returns a string with all matches of a regex pattern groups replaced by a replacement. |
Strings | Extract strings from a file with optional filter - similar to binutils strings command |
GetTime | Retrieves the current date and time. |
CalculateTimeDifference | Calculate the time difference, in minutes |
ExtractEmailV2 | Verifies that an email address is valid and only returns the address if it is valid. |
BinarySearchPy | Deprecated. No available replacement. Search for a binary on an endpoint using Carbon Black |
DisableUserWrapper | This script allows disabling a specified user using one or more of the following integrations: SailPointIdentityIQ, ActiveDirectoryQuery, Okta, MicrosoftGraphUser, and IAM. |
DumpJSON | Dumps a json from context key input, and returns a json object string result |
GetDomainDNSDetails | Returns DNS details for a domain. |
ShowScheduledEntries | Show all scheduled entries for specific incident. |
ProvidesCommand | Finds which integrations implement a specific Demisto command. The results will be returned as comma-separated values (CSV). The "Core REST API" integration must first be enabled. |
ChangeRemediationSLAOnSevChange | Changes the remediation SLA once a change in incident severity occurs. |
CreateNewIndicatorsOnly | Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue. |
enrich_exclude_button | This script is only meant to be used to disable the Enrich Excluded button in an indicator. It should not be used otherwise. |
GetIndicatorDBotScore | Add into the incident's context the system internal DBot score for the input indicator. |
SSDeepReputation | Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system. |
DBotUpdateLogoURLPhishing | Add, remove, or modify logos from the URL Phishing model. |
PrettyPrint | Pretty-print data using Python's pprint library. This is useful for seeing the structure of incident and context data. Here's how to use it: !PrettyPrint value=${incident} |
AnalyzeTimestampIntervals | Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps. |
EmailReputation | A context script for Email entities. |
ExtractHyperlinksFromOfficeFiles | Extracts hyperlinks from office files. Supported file types are: xlsx, docx, pptx. |
IsDomainInternal | The script takes one or more domain names and checks whether they're in the Cortex XSOAR list defined in the InternalDomainsListName argument. By default, the InternalDomainsListName argument will use the Cortex XSOAR list called "InternalDomains". |
ResolveShortenedURL | This script resolves the original URL from a given shortened URL and places the resolved URL in the playbook context and output. |
IsUrlPartOfDomain | Checks if the supplied URLs are in the specified domains. |
DisplayHTMLWithImages | Display HTML with embedded images. |
BreachConfirmationHTML | |
GenerateInvestigationSummaryReport | A script to generate investigation summary report in an automated way |
PortListenCheck | Checks whether a port was open on given host. |
IPNetwork | Gather information regarding CIDR - |
GetIndicatorDBotScoreFromCache | Get the overall score for the indicator as calculated by DBot. |
ShowLocationOnMap | Show indicator geo location on map. |
UnzipFile | Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context. |
MarkAsEvidenceByTag | Mark entries as evidence if they are tagged with given tag |
ToTable | Convert an array to a nice table display. Usually, from the context. |
emailFieldTriggered | Sends email to incident owner when selected field is triggered. |
HTTPListRedirects | List the redirects for a given URL |
PcapHTTPExtractor | Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file. |
CertificateExtract | Extract fields from a certificate file and return the standard context. |
listExecutedCommands | Lists executed commands in War Room |
Exists | Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors. |
FileToBase64List | Encode a file as base64 and store it in a Demisto list. |
Base64Encode | Will encode an input using Base64 format. |
ReadPDFFileV2 | Load a PDF file's content and metadata into context. Supports extraction of hashes, urls, and emails when available. |
Ping | Pings an IP or url address, to verify it's up. Note - On Cortex XSOAR 8 and Cortex XSIAM, the script can run only on a custom engine. |
commentsToContext | Takes the comments of a given entry ID and stores them in the incident context, under a provided context key. |
Prints text to war room (Markdown supported) | |
isError | Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error. |
GetListRow | Parses a list by header and value. |
SetIndicatorGridField | This script updates an indicator's grid field in Cortex XSOAR with provided row data. You can input the rows directly or extract them from the context. |
IsIntegrationAvailable | Returns 'yes' if integration brand is available. Otherwise returns 'no'. |
ParseHTMLIndicators | This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions. |
ShowIncidentIndicators | This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL. |
DisplayHTML | Display HTML in the War Room. |
IndicatorMaliciousRatioCalculation | Return indicators appears in resolved incidents, and resolved incident ids. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
ExposeIncidentOwner | Expose the incident owner into IncidentOwner context key |
CheckIndicatorValue | Check if indicators exist in the Threat Intel database. |
LessThanPercentage | Checks if one percentage is less than another |
UnEscapeIPs | Remove escaping chars from IP |
FileCreateAndUploadV2 | Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room. |
ContextGetHashes | Gets hashes (MD5,SHA1,SHA256) from context. |
VerifyCIDR | Verify that the CIDRs are valid. |
ticksToTime | Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft. |
JSONtoCSV | Convert a JSON War Room output via EntryID to a CSV file. |
GetLicenseID | Returns the license ID. |
ParseWordDoc | Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents. |
GetByIncidentId | Gets a value from the specified incident's context. |
IsEmailAddressInternal | Checks if the email address is part of the internal domains. |
IncreaseIncidentSeverity | Optionally increases the incident severity to the new value if it is greater than the existing severity. |
hideFieldsOnNewIncident | When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode. |
GetInstances | Returns integration instances configured in Cortex XSOAR. You can filter by instance status and/or brand name (vendor). |
ExtractAttackPattern | Extract Attack Pattern Threat Intel Object. After auto extract extracts the Attack Pattern IDs, this script is executed and extracts the value (name) of the Attack Pattern. |
ConvertFile | Converts a file from one format to a different format by using the convert-to function of Libre Office. For a list of supported input/output formats see: https://wiki.openoffice.org/wiki/Framework/Article/Filter/FilterList_OOo_3_0 |
PDFUnlocker | Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF. |
EncodeToAscii | Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII) |
FileReputation | A context script for hash entities. |
ContextGetPathForString | Searches for string in context and returns context path, returns null if not found. |
TextFromHTML | Extract regular text from the given HTML. |
HttpV2 | Sends a HTTP request with advanced capabilities |
ExtractDomainFromUrlAndEmail | Extract Domain(s) from URL(s) and/or Email(s). |
WordTokenizer | Deprecated. Use DBotPreProcessTextData instead. |
FailedInstances | Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances. |
AppendindicatorFieldWrapper | A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators. |
PublishEntriesToContext | Publish entries to incident's context |
IsListExist | Check if list exist in demisto lists. |
SearchIndicator | Searches Cortex XSOAR Indicators. Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument. |
ConvertTimezoneFromUTC | Takes UTC and converts it to the specified timezone. Format must match the UTC date's format and output will be the same format. Can use in conjunction with ConvertDateToString |
Base64EncodeV2 | Encodes an input to Base64 format. |
OnionURLReputation | This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators. |
IncidentFields | Returns a dict of all incident fields that exist in the system. |
RunPollingCommand | Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
CVSSCalculator | This script calculates the CVSS Base Score, Temporal Score, and Environmental Score using either the CVSS 3.0 or CVSS 3.1 calculator according to https://www.first.org/cvss/ calculation documentation. |
UtilAnyResults | Utility script to use in playbooks - returns "yes" if the input is non-empty. |
SetDateField | Sets a custom incident field with current date |
ConvertDatetoUTC | Converts a date from a different timezone to UTC timezone. |
CountArraySize | Count an array size |
ContextSearchForString | Searches for string in a path in context. If path is null, string will be searched in full context. |
ParseExcel | The automation takes Excel file (entryID) as an input and parses its content to the war room and context. |
ExportIndicatorsToCSV | This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room. |
LoadJSONFileToContext | Loads a JSON file from the war room to context. |
DecodeMimeHeader | Decode MIME base64 headers. |
BMCTool | Parse RDP bitmap cache data into a single collage image file. |
ArrayToCSV | Converts a simple Array into a textual comma separated string |
PreProcessImage | This script pre-processes (resizes, sharpens, and grayscales) an image file from context, given an entry_id. |
URLSSLVerification | Verify URL SSL certificate |
EmailAskUser | Ask a user a question via email and process the reply directly into the investigation. |
MapValues | Map the given values to the translated values. If given values: a,b,c and translated: 1,2,3 then input is a will return 1 |
LookupCSV | Parses a CSV and looks for a specific value in a specific column, returning a dict of the entire matching row. If no column value is specified, the entire CSV is read into the context. |
IsInternalDomainName | This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain. |
CreateArray | Will create an array object in context from given string input |
Name | Description |
---|---|
Company has Insurance for the Breach | |
Size - number of employees | |
Individuals Notification | |
Approximate number of affected data subjects | |
Date/time of the breach | |
Possible Cause of the Breach | |
Company Country | |
Country where business has its main establishment | "‘main establishment’ means: as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;" - GDPR Art. 4 |
Postal Code | |
Where is data hosted | |
Size - turnover | |
Health insurance breached | Is health insurance breached |
Company City | |
GDPR Notify Authorities | "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." - GDPR Art. 33 |
Measures to Mitigate | " (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects." - GDPR Art. 33 |
Consumer Reporting Agencies Notification | |
Affected data | "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" - GDPR Art. 4 |
State CISO Notification | |
Resident Notification Option | |
Affected Individuals Contact Information | |
DPO E-mail Address | |
Contact Address | |
Malicious Cause (If the cause is a malicious attack) | |
Contact Name | |
Residents Email Address | |
Sector of Affected Party | |
Company Name | |
Affected Data Type | |
Contact Email address | |
State where the breach took place | |
Attorney General Notification | |
Financial information breached | Is financial information breached |
Medical Information breached | Is Medical Information breached |
Unique identification number breached | Is unique identification number breached |
DPO Notification | |
Management Notification | |
Is the Data Subject to DPIA | |
Country where the breach took place | |
Unique biometric data breached | Is unique biometric data breached |
PII Data Type | |
Other PII data breached | Is other PII data breached |
E-mail Address | |
Likely Impact | "A data protection impact assessment (…) shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale. - GDPR Art. 35 |
Data Encryption Status | |
Company Address | |
Telephone no. | |
Media Notification | The status of the media notification |
Secretary Notification | |
Breach Confirmation | Is the DPO confirm the breach |
Company Postal Code | |
Contact Telephone number | |
Account information breached | Is account information breached |
Name | Description |
---|---|
InternalDomains | |
PrivateIPs |
Name | Description |
---|---|
PortListenCheck | Checks whether a port was open on given host. |
ExportToXLSX | Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file. |
IPNetwork | Gather information regarding CIDR - |
GenerateAsBuilt | Generate an as built document, as HTML, based on the running XSOAR instance. Requires an instance of the Demisto API integration configured. |
IsIntegrationAvailable | Returns 'yes' if integration brand is available. Otherwise returns 'no'. |
ShowOnMap | Returns a map entry with a marker on the given coordinates (lat,lng), or address (requires a configured GoogleMaps instance). |
RepopulateFiles | After running DeleteContext, this script can repopulate all the file entries in the ${File} context key |
TopMaliciousRatioIndicators | Find the top malicious ratio indicators. |
checkValue | Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly. |
FindSimilarIncidents | Deprecated. Use DBotFindSimilarIncidents instead. Finds similar incidents by common incident keys, labels, custom fields or context keys. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
FindSimilarAlerts | Deprecated. Use DBotFindSimilarAlerts instead. Finds similar alerts by common alert keys, labels, custom fields or context keys. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
AddDBotScoreToContext | Add DBot score to context for indicators with custom vendor, score, reliability, and type. |
enrich_exclude_button | This script is only meant to be used to disable the Enrich Excluded button in an indicator. It should not be used otherwise. |
EmailAskUser | Ask a user a question via email and process the reply directly into the investigation. |
clear-user-session | This script clears user sessions across multiple integrations for a list of usernames. |
MapValues | Map the given values to the translated values. If given values: a,b,c and translated: 1,2,3 then input is a will return 1 |
TimeStampCompare | Compares a single timestamp to a list of timestamps. |
PrintContext | Pretty-print the contents of the playbook context. |
DownloadAndArchivePythonLibrary | The script downloads a Python library using PIP, archives it, and returns the file to the war room. |
ExtractDomainFromUrlAndEmail | Extract Domain(s) from URL(s) and/or Email(s). |
EmailReputation | A context script for Email entities. |
ExportToCSV | Export given array to csv file. |
UnPackFile | Deprecated. Use the UnzipFile script instead. UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context. |
FileCreateAndUpload | Deprecated. Use FileCreateAndUploadV2 instead. Will create a file (using the given data input or entry ID) and upload it to current investigation war room. |
StopScheduledTask | This stops the scheduled task whose ID is given in the taskID argument. |
ConvertFile | Converts a file from one format to a different format by using the convert-to function of Libre Office. For a list of supported input/output formats see: https://wiki.openoffice.org/wiki/Framework/Article/Filter/FilterList_OOo_3_0 |
ExposeIncidentOwner | Expose the incident owner into IncidentOwner context key |
ExposeAlertOwner | Expose the alert owner into AlertOwner context key |
FileToBase64List | Encode a file as base64 and store it in a Demisto list. |
CompareIncidentsLabels | Compares the labels of two incidents. Returns the labels that are unique to each incident. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
CompareAlertsLabels | Compares the labels of two alerts. Returns the labels that are unique to each alert. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
GetInstances | Returns integration instances configured in Cortex. You can filter by instance status and/or brand name (vendor). |
ResolveShortenedURL | This script resolves the original URL from a given shortened URL and places the resolved URL in the playbook context and output. |
PrettyPrint | Pretty-print data using Python's pprint library. This is useful for seeing the structure of incident and context data. Here's how to use it: !PrettyPrint value=${incident} |
ExportIncidentsToCSV | This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room. |
ExportAlertsToCSV | This automation uses the Core REST API Integration to batch export Alerts to CSV and return the resulting CSV file to the war room. |
AquatoneDiscoverV2 | aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery. |
PreProcessImage | This script pre-processes (resizes, sharpens, and grayscales) an image file from context, given an entry_id. |
GetIndicatorDBotScore | Add into the incident's context the system internal DBot score for the input indicator. |
GetLicenseID | Returns the license ID. |
IsolationAssetWrapper | This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex.0.0). |
ExtractIndicatorsFromWordFile | Used to extract indicators from Word files (DOC, DOCX). This automation runs using the default Limited User role, unless you explicitly change the permissions. |
Dig | DNS lookup utility to provide 'A' and 'PTR' record |
ContentPackInstaller | Content packs installer from marketplace. |
DeduplicateValuesbyKey | Given a list of objects and a key found in each of those objects, return a unique list of values associated with that key. Returns error if the objects provided do not contain the key of interest. |
StixCreator | Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format. |
CheckSenderDomainDistance | Get the string distance for the sender from our domain |
MarkAsEvidenceByTag | Mark entries as evidence if they are tagged with given tag |
ChangeContext | Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values. |
ExampleJSScript | This is only an example script, to showcase how to use and write JavaScript scripts |
CertificateExtract | Extract fields from a certificate file and return the standard context. |
ParseWordDoc | Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents. |
BreachConfirmationHTML | |
GeneratePassword | This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of random length including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. The min_* values all default to 0. This means that if the command is executed in this way: The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics. |
DisplayHTML | Display HTML in the War Room. |
IsInternalDomainName | This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain. |
GenerateRandomString | Generates random string |
MatchRegexV2 | Extracts regex data from the provided text. The script support groups and looping. |
UnzipFile | Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context. |
LinkIncidentsButton | Incident action button script to link or unlink Incidents from an Incident |
LinkAlertsButton | Alert action button script to link or unlink Alerts from an Alert |
CheckIndicatorValue | Check if indicators exist in the Threat Intel database. |
IPReputation | A context script for IP entities. |
IsInternalHostName | Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix. |
RemoteExec | Execute a command on a remote machine (without installing a D2 agent) |
IsTrue | Check if a given value is true. Will return 'no' otherwise |
ContextGetPathForString | Searches for string in context and returns context path, returns null if not found. |
GetDockerImageLatestTag | Gets docker image latest tag. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with the docker image latest tag if all is good, otherwise will return an error. |
AppendindicatorFieldWrapper | A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators. |
PDFUnlocker | Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF. |
HttpV2 | Sends a HTTP request with advanced capabilities |
ZipStrings | Joins values from two lists by index according to a given format. |
FileCreateAndUploadV2 | Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room. |
SSDeepSimilarity | This script finds similar files that can be related to each other by fuzzy hash (SSDeep). |
IsEmailAddressInternal | Checks if the email address is part of the internal domains. |
SetByIncidentId | Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
SetByAlertId | Works the same as the 'Set' command, but can work across alerts by specifying 'id' as an argument. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
PrintRaw | Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression. |
PrintToParentIncident | Prints a value to the parent incident's war-room of the current alert. |
URLReputation | A context script for URL entities. |
CreateHash | Creating a hash of a given input, support sha1, sha256, sha512, md5 and blake. Wrapper for https://docs.python.org/3/library/hashlib.html. |
JsonUnescape | Recursively un-escapes JSON data if escaped JSON is found |
IsListExist | Check if list exist in demisto lists. |
CheckContextValue | This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values. |
ParseHTMLIndicators | This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions. |
GetDuplicatesMlv2 | Deprecated. Use the "PhishingDedupPreprocessingRule" script instead. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
UnEscapeIPs | Remove escaping chars from IP |
GetEnabledInstances | Gets all currently enabled integration instances. |
ConvertTimezoneFromUTC | Takes UTC and converts it to the specified timezone. Format must match the UTC date's format and output will be the same format. Can use in conjunction with ConvertDateToString |
SetDateField | Sets a custom incident field with current date |
GenerateSummaryReports | Generate report summaries for the passed incidents. |
displayMappedFields | Display the mapped fields in a dynamic-section. |
TextFromHTML | Extract regular text from the given HTML. |
SearchIndicator | Searches Cortex Indicators. Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument. |
DomainReputation | A context script for Domain entities |
GenerateSummaryReportButton | This button will generate summary 'Case Report' template for a given Incident |
ConvertXmlToJson | Converts XML string to JSON format |
PublishEntriesToContext | Publish entries to incident's context |
FetchIndicatorsFromFile | Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types. |
MaliciousRatioReputation | Set indicator reputation to "suspicious" when malicious ratio is above threshold. |
PrintToAlert | Prints a value to the specified alert's war-room. The alert must be in status "Under Investigation". |
CompareLists | Compare two lists and put the differences in context. |
VerifyIPv6Indicator | Verify that the address is a valid IPv6 address. |
GetByIncidentId | Gets a value from the specified incident's context. |
GetByAlertId | Gets a value from the specified alert's context. |
GetIndicatorDBotScoreFromCache | Get the overall score for the indicator as calculated by DBot. |
ContainsCreditCardInfo | Check if a given value is true. Will return 'no' otherwise |
BMCTool | Parse RDP bitmap cache data into a single collage image file. |
ExportAuditLogsToFile | Uses the Core REST API integration to query the server audit trail logs, and return back a CSV or JSON file. |
JSONFileToCSV | Script to convert a War Room output JSON File to a CSV file. |
SSDeepReputation | Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system. |
ExifRead | Read image files metadata and provide Exif tags. |
FeedRelatedIndicatorsWidget | Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant. |
IncidentAddSystem | Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system) |
AlertAddSystem | Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system) |
VerifyJSON | Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet. |
http | Sends http request. Returns the response as json. |
CountArraySize | Count an array size |
StringSimilarity | This automation calculates the similarity ratio between every string in 2 different arrays and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common). |
ReadFile | Load the contents of a file into context. |
ExportIndicatorsToCSV | This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room. |
MathUtil | Script will run the provided mathematical action on 2 provided values and produce a result. |
Base64EncodeV2 | Encodes an input to Base64 format. |
SetIndicatorGridField | This script updates an indicator's grid field in Cortex with provided row data. You can input the rows directly or extract them from the context. |
ParseEmailFilesV2 | Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. This script is based on the parse-emails XSOAR python package, check the script documentation for more info. |
HTMLtoMD | Converts HTML to Markdown. |
FormatURL | Strips, unquotes and unescapes URLs. If the URL is a Proofpoint or ATP URL, extracts its redirect URL. If more than one URL is passed to the formatter, the separator must be a pipe ("|"). |
URLNumberOfAds | Fetches the numbers of ads in the given url. |
IsGreaterThan | Checks if one number(float) as bigger than the other(float) |
ParseYAML | Parses a YAML string into context |
ScheduleCommand | Schedule a command to run inside the war room at a future time (once or reoccurring) |
MITRENameByID_Formatter | Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data). |
CreateEmailHtmlBody | This script allows sending an HTML email, using a template stored as a list item under Lists (Settings -> Advanced -> Lists).
Note: Sending emails require an active Mail Sender integration instance. |
SetTime | Fill the current time in a custom incident field |
StringReplace | Replaces regex match/es in string. |
EditServerConfig | Edit the server configuration (under settings/troubleshooting). You can either add a new configuration or update and remove an existing one. |
SendMessageToOnlineUsers | Send message to Demisto online users over Email, Slack, Mattermost or all. |
CopyContextToField | Copy a context key to an incident field of multiple incidents, based on an incident query. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
CommandLineAnalysis | This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:
The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors. |
CheckFieldValue | This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. |
cveReputationV2 | Provides the severity of the CVE based on the CVSS score where available. |
ListUsedDockerImages | List all Docker images that are in use by the installed integrations and automations. |
ExtractFQDNFromUrlAndEmail | Extracts FQDNs from URLs and emails. |
AreValuesEqual | Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned. |
SCPPullFiles | Take a list of devices and pull a specific file (given by path) from each using SCP. |
SetMultipleValues | Set multiple keys/values to the context. |
ExtractEmailV2 | Verifies that an email address is valid and only returns the address if it is valid. |
ticksToTime | Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft. |
ToTable | Convert an array to a nice table display. Usually, from the context. |
CreateArray | Will create an array object in context from given string input |
DBotClosedIncidentsPercentage | Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts. |
DBotClosedAlertsPercentage | Data output script for populating dashboard pie graph widget with the percentage of alerts closed by DBot vs. alerts closed by analysts. |
RunPollingCommand | Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
MarkAsNoteByTag | Mark entries as notes if they are tagged with given tag. |
GetDataCollectionLink | Generates the URL for a Data Collection Task into Context. Can be used to get the url for tasks send via Email, Slack, or even if you select "By Task Only". To generate links for specific users, add an array of users in the users argument. |
GetErrorsFromEntry | Get the error(s) associated with a given entry/entries. Use ${lastCompletedTaskEntries} to check the previous task entries. The automation will return an array of the error contents from those entries. |
MatchRegex | Deprecated. Use the MatchRegexV2 script instead. |
ConvertCountryCodeCountryName | Convert country name to country code or country code to country name. |
LanguageDetect | Language detection based on Google's language-detection. |
get-user-data | This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context. |
ReadQRCode | Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code. |
IsUrlPartOfDomain | Checks if the supplied URLs are in the specified domains. |
CalculateEntropy | Calculates the entropy for the given data. |
ConvertTableToHTML | Converts a given array to an HTML table |
DeleteContext | Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
FilterByList | Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist. |
AddKeyToList | Adds/Replaces a key in key/value store backed by an XSOAR list. |
listExecutedCommands | Lists executed commands in War Room |
ParseExcel | The automation takes Excel file (entryID) as an input and parses its content to the war room and context. |
ExtractIndicatorsFromTextFile | Extract indicators from a text-based file.
This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
DisableUserWrapper | This script allows disabling a specified user using one or more of the following integrations: SailPointIdentityIQ, ActiveDirectoryQuery, Okta, MicrosoftGraphUser, and IAM. |
Base64Encode | Will encode an input using Base64 format. |
URLSSLVerification | Verify URL SSL certificate |
AnalyzeTimestampIntervals | Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps. |
ExportContextToJSONFile | Exports the Context for the current Incident to a JSON file in the war room. |
SetGridField | Creates a Grid table from items or key-value pairs. |
IsMaliciousIndicatorFound | Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found. |
DockerHardeningCheck | Checks if the Docker container running this script has been hardened according to the recommended settings at:
|
GenerateRandomUUID | Generates a random UUID (UUID 4). |
AssignAnalystToIncident | Assign analyst to incident. |
VerifyCIDR | Verify that the CIDRs are valid. |
ExtractHyperlinksFromOfficeFiles | Extracts hyperlinks from office files. Supported file types are: xlsx, docx, pptx. |
WordTokenizer | Deprecated. Use DBotPreProcessTextData instead. |
ArrayToCSV | Converts a simple Array into a textual comma separated string |
LoadJSON | Loads a json from string input, and returns a json object result. |
LessThanPercentage | Checks if one percentage is less than another |
IdentifyAttachedEmail | Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team. |
CertificateReputation | Enrich and calculate the reputation of a certificate indicator. |
StringLength | Returns the length of the string passed as argument |
PositiveDetectionsVSDetectionEngines | Shows a bar chart of the number of Positive Detections out of overall detections |
PrintToIncident | Prints a value to the specified incident's war-room. |
findIncidentsWithIndicator | Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
findAlertsWithIndicator | Lookup alerts with specified indicator. Use currentAlertId to omit the existing alert from output. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
ContextContains | This script searches for a value in a context path. |
Sleep | Sleep for X seconds. |
CVSSCalculator | This script calculates the CVSS Base Score, Temporal Score, and Environmental Score using either the CVSS 3.0 or CVSS 3.1 calculator according to https://www.first.org/cvss/ calculation documentation. |
cvss_color | This dynamic automation parses the CVSS score of a CVE and presents it in the layout in color according to its score. |
AssignToMeButton | Assigns the current Incident to the Cortex user who clicked the button |
VerdictResult | This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field. |
ConvertXmlFileToJson | Converts XML file entry to JSON format |
ZipFile | Zip a file and upload to war room. |
DecodeMimeHeader | Decode MIME base64 headers. |
Ping | Pings an IP or url address, to verify it's up. Note - On Cortex and Cortex XSIAM, the script can run only on a custom engine. |
ContextGetHashes | Gets hashes (MD5,SHA1,SHA256) from context. |
LookupCSV | Parses a CSV and looks for a specific value in a specific column, returning a dict of the entire matching row. If no column value is specified, the entire CSV is read into the context. |
DBotAverageScore | The script calculates the average DBot score for each indicator in the context. |
CreateIndicatorsFromSTIX | Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.x. This automation creates indicators and adds an indicator's relationships if available. |
BinarySearchPy | Deprecated. No available replacement. Search for a binary on an endpoint using Carbon Black |
SearchIncidentsSummary | Searches Cortex Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient. |
SearchAlertsSummary | Searches Cortex Alerts and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchAlertsV2 from the Common Scripts pack, but more efficient. |
RemoveKeyFromList | Removes a key in key/value store backed by an XSOAR list. |
Base64ListToFile | Converts Base64 file in a list to a binary file and upload to warroom |
Set | Set a value in context under the key you entered. |
ProvidesCommand | Finds which integrations implement a specific Demisto command. The results will be returned as comma-separated values (CSV). The "Core REST API" integration must first be enabled. |
PcapHTTPExtractor | Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file. |
ConvertDatetoUTC | Converts a date from a different timezone to UTC timezone. |
Prints text to war room (Markdown supported) | |
FileReputation | A context script for hash entities. |
ContextGetIps | Gets all IP addresses in context, excluding ones given. |
DisplayHTMLWithImages | Display HTML with embedded images. |
FailedInstances | Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances. |
ReadPDFFileV2 | Load a PDF file's content and metadata into context. Supports extraction of hashes, urls, and emails when available. |
AddEvidence | Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments) |
RunDockerCommand | This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container. We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context. |
ParseEmailFiles | Deprecated. Use ParseEmailFilesV2 instead." Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. |
GetStringsDistance | Get the string distance between inputString and compareString (compareString can be a comma-separated list) based on Levenshtein Distance algorithm. |
isError | Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error. |
GetFieldsByIncidentType | Returns the incident field names associated to the specified incident type. |
GetFieldsByAlertType | Returns the alert field names associated to the specified alert type. |
IncreaseIncidentSeverity | Optionally increases the incident severity to the new value if it is greater than the existing severity. |
IncreaseAlertSeverity | Optionally increases the alert severity to the new value if it is greater than the existing severity. |
GetTime | Retrieves the current date and time. |
UtilAnyResults | Utility script to use in playbooks - returns "yes" if the input is non-empty. |
ExtractAttackPattern | Extract Attack Pattern Threat Intel Object. After auto extract extracts the Attack Pattern IDs, this script is executed and extracts the value (name) of the Attack Pattern. |
ShowScheduledEntries | Show all scheduled entries for specific incident. |
SearchIncidentsV2 | Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
SearchAlertsV2 | Searches Demisto alerts. A summarized version of this scrips is available with the summarizedversion argument. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
CEFParser | Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields. |
ServerLogs | Uses the ssh integration to grab the host server logs. |
EncodeToAscii | Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII) |
IndicatorMaliciousRatioCalculation | Return indicators appears in resolved incidents, and resolved incident ids. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
ParseCSV | This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context. |
ShowLocationOnMap | Show indicator geo location on map. |
IsIPInRanges | Returns yes if the IP is in one of the ranges provided, returns no otherwise. |
commentsToContext | Takes the comments of a given entry ID and stores them in the incident context, under a provided context key. |
displayUtilitiesResults | This script displays the execution results of the tab's buttons in an HTML table format. |
Exists | Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors. |
ContextFilter | Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it. |
GetServerURL | Get the Server URL. |
ScheduleGenericPolling | Called by the GenericPolling playbook, schedules the polling task. |
PrintErrorEntry | Prints an error entry with a given message. |
GetDomainDNSDetails | Returns DNS details for a domain. |
ContextSearchForString | Searches for string in a path in context. If path is null, string will be searched in full context. |
Strings | Extract strings from a file with optional filter - similar to binutils strings command |
CopyNotesToIncident | Copy all entries marked as notes from current incident to another incident. |
CopyNotesToAlert | Copy all entries marked as notes from current alert to another alert. |
GetEntries | Collect entries matching to the conditions in the war room. |
EmailAskUserResponse | Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply. |
NumberOfPhishingAttemptPerUser | Shows a bar chart of the number of incident the 'To' and 'From' email addresses. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
CloseInvestigationAsDuplicate | Close the current investigation as duplicate to other investigation. |
CreateNewIndicatorsOnly | Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue. |
UnEscapeURLs | Extract URLs redirected by security tools like Proofpoint. |
ExtractHTMLTables | Find tables inside HTML and extract the contents into objects using the following logic:
|
SetAndHandleEmpty | Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions.
|
SetWithTemplate | Set a value built by a template in context under the key you entered. |
PopulateCriticalAssets | Populates critical assets in a grid field that has the section headers "Asset Type" and "Asset Name". |
EmailDomainSquattingReputation | Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm. |
JSONtoCSV | Convert a JSON War Room output via EntryID to a CSV file. |
PCAPMiner | Deprecated. Use PCAPMinerV2 instead. PCAPMiner is a tool to parse PCAP files and will return things like extracted files that are found, HTTP flows, and a variety of other information. It is uses a docker instance located on docker hub trorabaugh/dempcap:1.0. To use simply upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry id click on the link on the top right hand corner of a file attachment. |
ShowIncidentIndicators | This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL. |
ShowAlertIndicators | This script is used to display the indicators of an alert in an alert field of type Array. It can be used to select indicators from the alert in order to later perform some actions, like tagging the indicators for blocking via EDL. |
GenericPollingScheduledTask | Runs the polling command repeatedly, completes a blocking manual task when polling is done. |
emailFieldTriggered | Sends email to incident owner when selected field is triggered. |
GenerateInvestigationSummaryReport | A script to generate investigation summary report in an automated way |
ContextGetEmails | Gets all email addresses in context, excluding ones given. |
IncidentFields | Returns a dict of all incident fields that exist in the system. |
AlertFields | Returns a dict of all alert fields that exist in the system. |
GetListRow | Parses a list by header and value. |
ExtractDomainAndFQDNFromUrlAndEmail | Extracts domains and FQDNs from URLs and emails. |
CalculateTimeDifference | Calculate the time difference, in minutes |
OnionURLReputation | This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators. |
DumpJSON | Dumps a json from context key input, and returns a json object string result |
hideFieldsOnNewIncident | When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode. |
hideFieldsOnNewAlert | When you apply this script to an alert field, that alert field is hidden for new alerts, and it displays in edit mode. |
GridFieldSetup | Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. Instead of a value you can enter |
IPToHost | Try to get the hostname correlated with the input IP. |
NotInContextVerification | Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution. |
ReplaceMatchGroup | Returns a string with all matches of a regex pattern groups replaced by a replacement. |
HTTPListRedirects | List the redirects for a given URL |
ServerLogs_docker | Uses the ssh integration to grab the host server logs. |
IsValueInArray | Indicates whether a given value is a member of given array |
LoadJSONFileToContext | Loads a JSON file from the war room to context. |
Name | Description |
---|---|
Unique biometric data breached | Is unique biometric data breached |
Country where business has its main establishment | "‘main establishment’ means: as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;" - GDPR Art. 4 |
Contact Name | |
Resident Notification Option | |
Data Encryption Status | |
Company has Insurance for the Breach | |
Financial information breached | Is financial information breached |
Account information breached | Is account information breached |
Secretary Notification | |
Malicious Cause (If the cause is a malicious attack) | |
Management Notification | |
State CISO Notification | |
Company Name | |
PII Data Type | |
Sector of Affected Party | |
Unique identification number breached | Is unique identification number breached |
Consumer Reporting Agencies Notification | |
Health insurance breached | Is health insurance breached |
Media Notification | The status of the media notification |
Affected Individuals Contact Information | |
Attorney General Notification | |
Approximate number of affected data subjects | |
Size - number of employees | |
Individuals Notification | |
Where is data hosted | |
Likely Impact | "A data protection impact assessment (…) shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale. - GDPR Art. 35 |
Postal Code | |
Medical Information breached | Is Medical Information breached |
E-mail Address | |
Company Address | |
DPO E-mail Address | |
Company Postal Code | |
Company City | |
Affected data | "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" - GDPR Art. 4 |
Contact Address | |
Is the Data Subject to DPIA | |
Affected Data Type | |
Breach Confirmation | Is the DPO confirm the breach |
GDPR Notify Authorities | "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." - GDPR Art. 33 |
State where the breach took place | |
Size - turnover | |
Contact Telephone number | |
Telephone no. | |
Contact Email address | |
Other PII data breached | Is other PII data breached |
Possible Cause of the Breach | |
DPO Notification | |
Residents Email Address | |
Measures to Mitigate | " (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects." - GDPR Art. 33 |
Name | Description |
---|---|
PrivateIPs |
Pack Name | Pack By |
---|---|
Base | By: Cortex XSOAR |
Cortex REST API | By: Cortex XSOAR |
Pack Name | Pack By |
---|---|
US - Breach Notification | By: Cortex XSOAR |
Brute Force | By: Cortex XSOAR |
Elasticsearch | By: Cortex XSOAR |
MITRE ATT&CK | By: Cortex XSOAR |
GDPR | By: Cortex XSOAR |
Gmail | By: Cortex XSOAR |
Gmail Single User | By: Cortex XSOAR |
HIPAA - Breach Notification | By: Cortex XSOAR |
IBM Security QRadar SOAR | By: Cortex XSOAR |
Mail Sender (New) | By: Cortex XSOAR |
Microsoft Graph Mail | By: Cortex XSOAR |
ProtectWise | By: Cortex XSOAR |
Remote Access | By: Cortex XSOAR |
Shodan | By: Cortex XSOAR |
Sumo Logic | By: Cortex XSOAR |
Pack Name | Pack By |
---|---|
Cortex REST API | By: Cortex XSOAR |
Base | By: Cortex XSOAR |
Scripts
SearchIncidentsV2
- Documentation and metadata improvements.
CopyNotesToIncident
- Fixed an issue where indicators were auto-extracted from the copied notes regardless of the value of the auto_extract argument.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
New: CommandLineAnalysis
- New: This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:
- 0-25: Low Risk
- 26-50: Medium Risk
- 51-90: High Risk
- 91-100: Critical Risk
The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.
- 37611
Download
Scripts
New: MITRENameByID_Formatter
New: Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).
IndicatorMaliciousRatioCalculation
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
RunPollingCommand
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
ExtractIndicatorsFromTextFile
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
NumberOfPhishingAttemptPerUser
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
DeleteContext
- Documentation and metadata improvements.
CopyContextToField
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
ExtractIndicatorsFromWordFile
- Documentation and metadata improvements.
SetAndHandleEmpty
- Documentation and metadata improvements.
CompareIncidentsLabels
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
findIncidentsWithIndicator
- Documentation and metadata improvements.
MarkRelatedIncidents
- Documentation and metadata improvements.
DockerHardeningCheck
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
GetDuplicatesMlv2
- Documentation and metadata improvements.
SetByIncidentId
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
SearchIncidentsV2
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/python3:3.11.10.116949.
FindSimilarIncidents
- Documentation and metadata improvements.
- 37760
Download
Scripts
FormatURL
Fixed an issue where URLs were not parsed correctly when handling nested parenthesis in the URL query.
ExportToXLSX
- Updated the Docker image to: demisto/xslxwriter:1.0.0.117330.
AquatoneDiscoverV2
- Updated the Docker image to: demisto/aquatone:2.0.0.117469.
ReadQRCode
- Updated the Docker image to: demisto/qrcode:1.0.0.117542.
- 37639
Download
Scripts
ParseWordDoc
- Updated the Docker image to: demisto/office-utils:2.0.0.117810.
ParseHTMLIndicators
- Updated the Docker image to: demisto/bs4-tld:1.0.0.117606.
ExtractIndicatorsFromWordFile
- Updated the Docker image to: demisto/office-utils:2.0.0.117810.
ConvertFile
- Updated the Docker image to: demisto/office-utils:2.0.0.117810.
ExtractHyperlinksFromOfficeFiles
- Updated the Docker image to: demisto/office-utils:2.0.0.117810.
- 37620
- 37619
- 37618
- 37617
Download
Scripts
get-user-data
- Updated the script to ensure that all data returned from each command is also returned to the context.
- Updated the script to include the source of the data in the context for each field.
ExtractIndicatorsFromWordFile
Internal code improvements.
- 37431
Download
Scripts
ExportToCSV
Improved consistency of the script output by removing carriage return (\r) characters from the end of lines.
SetGridField
- Updated the Docker image to: demisto/pandas:1.0.0.117209.
GenerateAsBuilt
- Updated the Docker image to: demisto/teams:1.0.0.116912.
- 37425
- 37421
- 37419
- 37422
- 37418
- 37420
Download
Scripts
ExtractHyperlinksFromOfficeFiles
- Updated the Docker image to: demisto/office-utils:2.0.0.117112.
ParseWordDoc
- Updated the Docker image to: demisto/office-utils:2.0.0.117112.
ExtractIndicatorsFromWordFile
- Updated the Docker image to: demisto/office-utils:2.0.0.117112.
ExtractHTMLTables
- Updated the Docker image to: demisto/bs4-py3:1.0.0.117152.
ConvertFile
- Updated the Docker image to: demisto/office-utils:2.0.0.117112.
- 37378
- 37355
- 37356
- 37357
Download
Scripts
DeduplicateValuesbyKey
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SendEmailOnSLABreach
- Updated the Docker image to: demisto/python3:3.11.10.115186.
TimeStampCompare
- Updated the Docker image to: demisto/python3:3.11.10.115186.
URLNumberOfAds
- Updated the Docker image to: demisto/python3:3.11.10.115186.
DisplayHTML
- Updated the Docker image to: demisto/python3:3.11.10.115186.
VerdictResult
- Updated the Docker image to: demisto/python3:3.11.10.115186.
IsListExist
- Updated the Docker image to: demisto/python3:3.11.10.115186.
LookupCSV
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetIndicatorDBotScore
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ZipStrings
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CreateIndicatorsFromSTIX
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetLicenseID
- Updated the Docker image to: demisto/python3:3.11.10.115186.
hideFieldsOnNewIncident
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ExportIncidentsToCSV
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ResolveShortenedURL
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SearchIndicator
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ExtractIndicatorsFromTextFile
- Updated the Docker image to: demisto/python3:3.11.10.115186.
Base64EncodeV2
- Updated the Docker image to: demisto/python3:3.11.10.115186.
VerifyIPv6Indicator
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ReadFile
- Updated the Docker image to: demisto/python3:3.11.10.115186.
PrintErrorEntry
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SCPPullFiles
- Updated the Docker image to: demisto/python3:3.11.10.115186.
DecodeMimeHeader
- Updated the Docker image to: demisto/python3:3.11.10.115186.
HTTPListRedirects
- Updated the Docker image to: demisto/python3:3.11.10.115186.
StopTimeToAssignOnOwnerChange
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SetMultipleValues
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ConvertCountryCodeCountryName
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ParseCSV
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SearchIncidentsSummary
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CertificateReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
BMCTool
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CheckIndicatorValue
- Updated the Docker image to: demisto/python3:3.11.10.115186.
AddKeyToList
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ChangeRemediationSLAOnSevChange
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetInstances
- Updated the Docker image to: demisto/python3:3.11.10.115186.
IdentifyAttachedEmail
- Updated the Docker image to: demisto/python3:3.11.10.115186.
JSONtoCSV
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CreateHash
- Updated the Docker image to: demisto/python3:3.11.10.115186.
DumpJSON
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ServerLogs_docker
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ScheduleGenericPolling
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ConvertTimezoneFromUTC
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GridFieldSetup
- Updated the Docker image to: demisto/python3:3.11.10.115186.
TextFromHTML
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SetIndicatorGridField
- Updated the Docker image to: demisto/python3:3.11.10.115186.
enrich_exclude_button
- Updated the Docker image to: demisto/python3:3.11.10.115186.
PrettyPrint
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CheckSenderDomainDistance
- Updated the Docker image to: demisto/python3:3.11.10.115186.
Base64ListToFile
- Updated the Docker image to: demisto/python3:3.11.10.115186.
DomainReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CopyNotesToIncident
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SetWithTemplate
- Updated the Docker image to: demisto/python3:3.11.10.115186.
UtilAnyResults
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ChangeContext
- Updated the Docker image to: demisto/python3:3.11.10.115186.
cveReputationV2
- Updated the Docker image to: demisto/python3:3.11.10.115186.
MaliciousRatioReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ExtractEmailV2
- Updated the Docker image to: demisto/python3:3.11.10.115186.
FeedRelatedIndicatorsWidget
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ArrayToCSV
- Updated the Docker image to: demisto/python3:3.11.10.115186.
DisplayHTMLWithImages
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ParseYAML
- Updated the Docker image to: demisto/python3:3.11.10.115186.
IsolationAssetWrapper
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GeneratePassword
- Updated the Docker image to: demisto/python3:3.11.10.115186.
DisableUserWrapper
- Updated the Docker image to: demisto/python3:3.11.10.115186.
StringSimilarity
- Updated the Docker image to: demisto/python3:3.11.10.115186.
PortListenCheck
- Updated the Docker image to: demisto/python3:3.11.10.115186.
PrintContext
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ShowIncidentIndicators
- Updated the Docker image to: demisto/python3:3.11.10.115186.
JSONFileToCSV
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CheckContextValue
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetStringsDistance
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetServerURL
- Updated the Docker image to: demisto/python3:3.11.10.115186.
IPReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
OnionURLReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
URLSSLVerification
- Updated the Docker image to: demisto/python3:3.11.10.115186.
AppendindicatorFieldWrapper
- Updated the Docker image to: demisto/python3:3.11.10.115186.
StopScheduledTask
- Updated the Docker image to: demisto/python3:3.11.10.115186.
URLReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ServerLogs
- Updated the Docker image to: demisto/python3:3.11.10.115186.
get-user-data
- Updated the Docker image to: demisto/python3:3.11.10.115186.
PositiveDetectionsVSDetectionEngines
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ExportAuditLogsToFile
- Updated the Docker image to: demisto/python3:3.11.10.115186.
RunPollingCommand
- Updated the Docker image to: demisto/python3:3.11.10.115186.
RunDockerCommand
- Updated the Docker image to: demisto/python3:3.11.10.115186.
DBotAverageScore
- Updated the Docker image to: demisto/python3:3.11.10.115186.
FilterByList
- Updated the Docker image to: demisto/python3:3.11.10.115186.
RemoveKeyFromList
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CalculateEntropy
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GenerateAsBuiltConfiguration
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ExtractAttackPattern
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetEnabledInstances
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SearchIncidentsV2
- Updated the Docker image to: demisto/python3:3.11.10.115186.
EmailReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
FileCreateAndUploadV2
- Updated the Docker image to: demisto/python3:3.11.10.115186.
PrintRaw
- Updated the Docker image to: demisto/python3:3.11.10.115186.
IsUrlPartOfDomain
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ProvidesCommand
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetFieldsByIncidentType
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ReplaceMatchGroup
- Updated the Docker image to: demisto/python3:3.11.10.115186.
VerifyCIDR
- Updated the Docker image to: demisto/python3:3.11.10.115186.
MatchRegexV2
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetByIncidentId
- Updated the Docker image to: demisto/python3:3.11.10.115186.
cvss_color
- Updated the Docker image to: demisto/python3:3.11.10.115186.
Strings
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetListRow
- Updated the Docker image to: demisto/python3:3.11.10.115186.
IncidentFields
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ShowLocationOnMap
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetIndicatorDBotScoreFromCache
- Updated the Docker image to: demisto/python3:3.11.10.115186.
FileReputation
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetEntries
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CheckFieldValue
- Updated the Docker image to: demisto/python3:3.11.10.115186.
RepopulateFiles
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetDockerImageLatestTag
- Updated the Docker image to: demisto/python3:3.11.10.115186.
AnalyzeTimestampIntervals
- Updated the Docker image to: demisto/python3:3.11.10.115186.
LoadJSON
- Updated the Docker image to: demisto/python3:3.11.10.115186.
TopMaliciousRatioIndicators
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ExportIndicatorsToCSV
- Updated the Docker image to: demisto/python3:3.11.10.115186.
BreachConfirmationHTML
- Updated the Docker image to: demisto/python3:3.11.10.115186.
ListUsedDockerImages
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SetByIncidentId
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetDataCollectionLink
- Updated the Docker image to: demisto/python3:3.11.10.115186.
SetTime
- Updated the Docker image to: demisto/python3:3.11.10.115186.
GetErrorsFromEntry
- Updated the Docker image to: demisto/python3:3.11.10.115186.
FormatURL
- Updated the Docker image to: demisto/python3:3.11.10.115186.
CreateNewIndicatorsOnly
- Updated the Docker image to: demisto/python3:3.11.10.115186.
FileToBase64List
- Updated the Docker image to: demisto/python3:3.11.10.115186.
MarkAsNoteByTag
- Updated the Docker image to: demisto/python3:3.11.10.115186.
- 37147
- 37137
- 37136
- 37140
- 37138
- 37139
Download
Scripts
Ping
- Updated the Docker image to: demisto/netutils:1.0.0.115452.
Dig
- Updated the Docker image to: demisto/netutils:1.0.0.115452.
GetDomainDNSDetails
- Updated the Docker image to: demisto/netutils:1.0.0.115452.
HTMLtoMD
- Updated the Docker image to: demisto/btfl-soup:1.0.1.115405.
ContentPackInstaller
- Updated the Docker image to: demisto/xsoar-tools:1.0.0.115559.
- 37108
- 37122
- 37109
- 37115
- 37124
- 37111
Download
Scripts
ParseExcel
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
DownloadAndArchivePythonLibrary
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
FetchIndicatorsFromFile
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
ExtractFQDNFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
ZipFile
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
StixCreator
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
ExifRead
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
ExtractDomainFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
LanguageDetect
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
ExtractDomainAndFQDNFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.114656.
cvss_color
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CheckSenderDomainDistance
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DisplayHTMLWithImages
- Updated the Docker image to: demisto/python3:3.11.10.113941.
Base64EncodeV2
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ResolveShortenedURL
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetByIncidentId
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CloseInvestigationAsDuplicate
- Updated the Docker image to: demisto/python3:3.11.10.113941.
Strings
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CheckIndicatorValue
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DisableUserWrapper
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ChangeContext
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetDockerImageLatestTag
- Updated the Docker image to: demisto/python3:3.11.10.113941.
AnalyzeTimestampIntervals
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IPToHost
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ShowLocationOnMap
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ExportIndicatorsToCSV
- Updated the Docker image to: demisto/python3:3.11.10.113941.
StopTimeToAssignOnOwnerChange
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ChangeRemediationSLAOnSevChange
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetDataCollectionLink
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GenerateAsBuiltConfiguration
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ExtractAttackPattern
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GenerateRandomString
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ExportContextToJSONFile
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ReadFile
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ScheduleGenericPolling
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ContextContains
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CreateHash
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IsolationAssetWrapper
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SearchIncidentsV2
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GeneratePassword
- Updated the Docker image to: demisto/python3:3.11.10.113941.
HTTPListRedirects
- Updated the Docker image to: demisto/python3:3.11.10.113941.
LoadJSONFileToContext
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CreateNewIndicatorsOnly
- Updated the Docker image to: demisto/python3:3.11.10.113941.
AddDBotScoreToContext
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SetMultipleValues
- Updated the Docker image to: demisto/python3:3.11.10.113941.
FeedRelatedIndicatorsWidget
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GenerateRandomUUID
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SetTime
- Updated the Docker image to: demisto/python3:3.11.10.113941.
PrettyPrint
- Updated the Docker image to: demisto/python3:3.11.10.113941.
cveReputationV2
- Updated the Docker image to: demisto/python3:3.11.10.113941.
VerifyCIDR
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IsListExist
- Updated the Docker image to: demisto/python3:3.11.10.113941.
get-user-data
- Updated the Docker image to: demisto/python3:3.11.10.113941.
LookupCSV
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DomainReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SCPPullFiles
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ParseCSV
- Updated the Docker image to: demisto/python3:3.11.10.113941.
AppendindicatorFieldWrapper
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CVSSCalculator
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetEntries
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ExportAuditLogsToFile
- Updated the Docker image to: demisto/python3:3.11.10.113941.
MaliciousRatioReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ZipStrings
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CheckContextValue
- Updated the Docker image to: demisto/python3:3.11.10.113941.
displayUtilitiesResults
- Updated the Docker image to: demisto/python3:3.11.10.113941.
RepopulateFiles
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CheckFieldValue
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IsUrlPartOfDomain
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ConvertCountryCodeCountryName
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GenerateSummaryReportButton
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ConvertDatetoUTC
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IsDomainInternal
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetEnabledInstances
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetServerURL
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DumpJSON
- Updated the Docker image to: demisto/python3:3.11.10.113941.
TimeStampCompare
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SetByIncidentId
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CompareLists
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ConvertTimezoneFromUTC
- Updated the Docker image to: demisto/python3:3.11.10.113941.
TextFromHTML
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ServerLogs_docker
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CalculateEntropy
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DockerHardeningCheck
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ListUsedDockerImages
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IncidentFields
- Updated the Docker image to: demisto/python3:3.11.10.113941.
FilterByList
- Updated the Docker image to: demisto/python3:3.11.10.113941.
FileReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
URLSSLVerification
- Updated the Docker image to: demisto/python3:3.11.10.113941.
NumberOfPhishingAttemptPerUser
- Updated the Docker image to: demisto/python3:3.11.10.113941.
PortListenCheck
- Updated the Docker image to: demisto/python3:3.11.10.113941.
URLReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IsInternalHostName
- Updated the Docker image to: demisto/python3:3.11.10.113941.
URLNumberOfAds
- Updated the Docker image to: demisto/python3:3.11.10.113941.
JSONtoCSV
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IPReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
PrintContext
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ReplaceMatchGroup
- Updated the Docker image to: demisto/python3:3.11.10.113941.
TopMaliciousRatioIndicators
- Updated the Docker image to: demisto/python3:3.11.10.113941.
UtilAnyResults
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ServerLogs
- Updated the Docker image to: demisto/python3:3.11.10.113941.
OnionURLReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
enrich_exclude_button
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetFieldsByIncidentType
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SetDateField
- Updated the Docker image to: demisto/python3:3.11.10.113941.
AssignToMeButton
- Updated the Docker image to: demisto/python3:3.11.10.113941.
AddKeyToList
- Updated the Docker image to: demisto/python3:3.11.10.113941.
PopulateCriticalAssets
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ExtractEmailV2
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SearchIncidentsSummary
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IsIPPrivate
- Updated the Docker image to: demisto/python3:3.11.10.113941.
FileToBase64List
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IsInternalDomainName
- Updated the Docker image to: demisto/python3:3.11.10.113941.
FileCreateAndUploadV2
- Updated the Docker image to: demisto/python3:3.11.10.113941.
RemoveKeyFromList
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DecodeMimeHeader
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DeduplicateValuesbyKey
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ExtractIndicatorsFromTextFile
- Updated the Docker image to: demisto/python3:3.11.10.113941.
LoadJSON
- Updated the Docker image to: demisto/python3:3.11.10.113941.
BreachConfirmationHTML
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DBotAverageScore
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CalculateTimeDifference
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SSDeepReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
MarkAsNoteByTag
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ShowIncidentIndicators
- Updated the Docker image to: demisto/python3:3.11.10.113941.
displayMappedFields
- Updated the Docker image to: demisto/python3:3.11.10.113941.
MarkAsEvidenceByTag
- Updated the Docker image to: demisto/python3:3.11.10.113941.
EncodeToAscii
- Updated the Docker image to: demisto/python3:3.11.10.113941.
PrintRaw
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetStringsDistance
- Updated the Docker image to: demisto/python3:3.11.10.113941.
HttpV2
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SetIndicatorGridField
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IndicatorMaliciousRatioCalculation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
EmailReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
PrintErrorEntry
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GridFieldSetup
- Updated the Docker image to: demisto/python3:3.11.10.113941.
JSONFileToCSV
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetIndicatorDBotScore
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CopyNotesToIncident
- Updated the Docker image to: demisto/python3:3.11.10.113941.
MatchRegexV2
- Updated the Docker image to: demisto/python3:3.11.10.113941.
IdentifyAttachedEmail
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetInstances
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ArrayToCSV
- Updated the Docker image to: demisto/python3:3.11.10.113941.
EditServerConfig
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetErrorsFromEntry
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CopyContextToField
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DisplayHTML
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetLicenseID
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetIndicatorDBotScoreFromCache
- Updated the Docker image to: demisto/python3:3.11.10.113941.
DemistoVersion
- Updated the Docker image to: demisto/python3:3.11.10.113941.
StringSimilarity
- Updated the Docker image to: demisto/python3:3.11.10.113941.
ParseYAML
- Updated the Docker image to: demisto/python3:3.11.10.113941.
VerifyIPv6Indicator
- Updated the Docker image to: demisto/python3:3.11.10.113941.
StopScheduledTask
- Updated the Docker image to: demisto/python3:3.11.10.113941.
RunDockerCommand
- Updated the Docker image to: demisto/python3:3.11.10.113941.
RunPollingCommand
- Updated the Docker image to: demisto/python3:3.11.10.113941.
BMCTool
- Updated the Docker image to: demisto/python3:3.11.10.113941.
VerdictResult
- Updated the Docker image to: demisto/python3:3.11.10.113941.
hideFieldsOnNewIncident
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CompareIncidentsLabels
- Updated the Docker image to: demisto/python3:3.11.10.113941.
PositiveDetectionsVSDetectionEngines
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SetWithTemplate
- Updated the Docker image to: demisto/python3:3.11.10.113941.
Base64ListToFile
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SearchIndicator
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CreateIndicatorsFromSTIX
- Updated the Docker image to: demisto/python3:3.11.10.113941.
FormatURL
- Updated the Docker image to: demisto/python3:3.11.10.113941.
SendEmailOnSLABreach
- Updated the Docker image to: demisto/python3:3.11.10.113941.
LinkIncidentsButton
- Updated the Docker image to: demisto/python3:3.11.10.113941.
GetListRow
- Updated the Docker image to: demisto/python3:3.11.10.113941.
CertificateReputation
- Updated the Docker image to: demisto/python3:3.11.10.113941.
LinkIncidentsWithRetry
- Updated the Docker image to: demisto/python3:3.11.10.113941.
- 36995
- 37051
- 37052
- 36992
- 37006
- 36997
- 36994
- 36998
- 36993
- 37059
Download
Scripts
PreProcessImage
- Updated the Docker image to: demisto/processing-image-file:1.0.0.113909.
PcapHTTPExtractor
- Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.113908.
- 36780
- 36769
- 36784
- 36766
- 36771
- 36498
- 36747
- 36773
- 36759
- 36725
- 36774
- 35865
Download
Scripts
SSDeepSimilarity
- Updated the Docker image to: demisto/ssdeep:1.0.0.112284.
PDFUnlocker
- Updated the Docker image to: demisto/readpdf:1.0.0.112283.
JsonUnescape
- Updated the Docker image to: demisto/python3-deb:3.11.10.112166.
ReadPDFFileV2
- Updated the Docker image to: demisto/readpdf:1.0.0.112283.
UnzipFile
- Updated the Docker image to: demisto/unzip:1.0.0.112289.
PcapHTTPExtractor
- Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.112272.
ReadQRCode
- Updated the Docker image to: demisto/qrcode:1.0.0.112357.
- 36505
- 36495
- 36494
- 36493
- 36492
- 36491
- 36490
- 36489
- 36486
- 36485
- 36484
- 36483
- 36488
- 36487
Download
Scripts
New: get-user-data
New: This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context. (Available from Cortex XSOAR 6.10.0).
ShowIncidentIndicators
- Fixed an issue with ShowIncidentIndicators fetching indicators with the same IDs.
- Updated the Docker image to: demisto/python3:3.11.10.111526.
- 36260
- 36657
Download
Scripts
ExtractFQDNFromUrlAndEmail
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/py3-tools:1.0.0.108682.
ExtractDomainAndFQDNFromUrlAndEmail
- Documentation and metadata improvements.
- Updated the Docker image to: demisto/py3-tools:1.0.0.108682.
- 36053
Download
Scripts
ScheduleGenericPolling
- Fixed an issue where the script failed when given values containing quotation marks.
- Updated the Docker image to: demisto/python3:3.11.9.107902.
GenericPollingScheduledTask
- Fixed an issue where the script failed when given values containing quotation marks.
- 35995
Download
Scripts
ExtractIndicatorsFromWordFile
- Updated the Docker image to: demisto/office-utils:2.0.0.107687.
ExtractHyperlinksFromOfficeFiles
- Updated the Docker image to: demisto/office-utils:2.0.0.107687.
ConvertFile
- Updated the Docker image to: demisto/office-utils:2.0.0.107687.
ParseWordDoc
- Updated the Docker image to: demisto/office-utils:2.0.0.107687.
- 35403
Download
Scripts
DBotUpdateLogoURLPhishing
Updated the Docker image to: demisto/mlurlphishing:1.0.0.103417.
New: GenerateAsBuiltConfiguration
- New: Generate a JSON file that can be downloaded and used to create the As-Built document for Cortex XSOAR. (Available from Cortex XSOAR 6.10.0).
- 35178
- 35115
Download
Scripts
VerifyIPv6Indicator
- Updated the IPv6 formatter to remove unneeded prefixed characters.
- Updated the Docker image to: demisto/python3:3.10.14.101217.
DisplayHTMLWithImages
- Fixed an issue where embedded images not appear in the Email Body section in the Phishing incident layout.
- Updated the Docker image to: demisto/python3:3.10.14.99474.
- 35135
Download
Scripts
ReadQRCode
- Improved implementation of
stderr
redirection by removingwurlitzer.pipes()
and redirectingstderr
to a temporary file. - The automation now extracts QR codes exclusively to improve performance.
- Updated the Docker image to: demisto/qrcode:1.0.0.98232.
- 34579
Download
Scripts
FetchIndicatorsFromFile
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
ExifRead
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
ExtractDomainAndFQDNFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
ExtractFQDNFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
LanguageDetect
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
StixCreator
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
ExtractDomainFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
ParseExcel
- Updated the Docker image to: demisto/py3-tools:1.0.0.96102.
- 34465
- 33830
- 33831
- 33828
- 33825
- 33805
- 33871
Download
Scripts
ParseWordDoc
- Updated the Docker image to: demisto/office-utils:2.0.0.93886.
DBotUpdateLogoURLPhishing
- Updated the Docker image to: demisto/mlurlphishing:1.0.0.90588.
SSDeepSimilarity
- Updated the Docker image to: demisto/ssdeep:1.0.0.93570.
PreProcessImage
- Updated the Docker image to: demisto/processing-image-file:1.0.0.93358.
AquatoneDiscoverV2
- Updated the Docker image to: demisto/aquatone:2.0.0.93318.
PcapHTTPExtractor
- Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.93351.
ReadPDFFileV2
- Updated the Docker image to: demisto/readpdf:1.0.0.93363.
ExtractIndicatorsFromWordFile
- Updated the Docker image to: demisto/office-utils:2.0.0.93886.
PDFUnlocker
- Updated the Docker image to: demisto/readpdf:1.0.0.93363.
- 34378
Download
Scripts
ExtractDomainFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.91504.
LanguageDetect
- Updated the Docker image to: demisto/py3-tools:1.0.0.91504.
ExifRead
- Updated the Docker image to: demisto/py3-tools:1.0.0.91504.
ParseExcel
- Updated the Docker image to: demisto/py3-tools:1.0.0.91504.
ZipFile
- Updated the Docker image to: demisto/py3-tools:1.0.0.91504.
ExtractFQDNFromUrlAndEmail
- Updated the Docker image to: demisto/py3-tools:1.0.0.91504.
- 33641
- 33516
- 33519
- 33515
- 33329
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33458
- 33535
- 33534
- 33537
- 33552
- 33580
- 33553
- 33418
- 33583
- 33555
- 33556
- 33559
- 33560
- 33619
- 33591
- 33602
- 33600
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33458
Download
Scripts
AquatoneDiscoverV2
- Updated the Docker image to: demisto/aquatone:2.0.0.89205.
FetchIndicatorsFromFile
- Updated the Docker image to: demisto/py3-tools:1.0.0.89345.
VerifyJSON
- Updated the Docker image to: demisto/powershell:7.4.0.80528.
- 33391
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33348
Download
Scripts
ScheduleGenericPolling
- Added support for propagating the
auto-extract
argument in both the initial and subsequent executions by introducing the extractMode argument. - Updated the Docker image to: demisto/python3:3.10.13.89009.
GenericPollingScheduledTask
- Added support for propagating the
auto-extract
argument in both the initial and subsequent executions by introducing the extractMode argument.
- 33146
Download
Scripts
CertificateExtract
- New: Extract fields from a certificate file and return the standard context. (Available from Cortex XSOAR 6.0.0).
- Updated the Docker image to: demisto/crypto:1.0.0.88857.
New: CertificateReputation
- New: Enrich and calculate the reputation of a certificate indicator. (Available from Cortex XSOAR 6.0.0).
FileCreateAndUploadV2
- Updated the Docker image to: demisto/python3:3.10.13.89009.
- 31341
Download
Scripts
StixCreator
- Fixed an issue where Export Stix failed when exporting a not STIX compatible object of type
Report
. - Updated the Docker image to demisto/py3-tools:1.0.0.88283.
ScheduleGenericPolling
- Fixed an issue where a value was not sanitized.
- Updated the Docker image to: demisto/python3:3.10.13.87159.
- 32878
Download
Scripts
LinkIncidentsWithRetry
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CVSSCalculator
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ExportContextToJSONFile
- Updated the Docker image to: demisto/python3:3.10.13.86272.
displayUtilitiesResults
- Updated the Docker image to: demisto/python3:3.10.13.86272.
PopulateCriticalAssets
- Updated the Docker image to: demisto/python3:3.10.13.86272.
LinkIncidentsButton
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ConvertDatetoUTC
- Updated the Docker image to: demisto/python3:3.10.13.86272.
AssignToMeButton
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IsDomainInternal
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IndicatorMaliciousRatioCalculation
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IPToHost
- Updated the Docker image to: demisto/python3:3.10.13.86272.
MarkAsEvidenceByTag
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CopyContextToField
- Updated the Docker image to: demisto/python3:3.10.13.86272.
AddDBotScoreToContext
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CloseInvestigationAsDuplicate
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SetDateField
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CompareIncidentsLabels
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ContextContains
- Updated the Docker image to: demisto/python3:3.10.13.86272.
GenerateSummaryReportButton
- Updated the Docker image to: demisto/python3:3.10.13.86272.
DemistoVersion
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IsIPPrivate
- Updated the Docker image to: demisto/python3:3.10.13.86272.
GenerateRandomString
- Updated the Docker image to: demisto/python3:3.10.13.86272.
EncodeToAscii
- Updated the Docker image to: demisto/python3:3.10.13.86272.
LoadJSONFileToContext
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CalculateTimeDifference
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IdentifyAttachedEmail
- Fixed an issue where the script was erroring when there were no File entries in the warroom.
- Updated the Docker image to: demisto/python3:3.10.13.87159.
- 32966
Download
Scripts
ExportToXLSX
- Updated the Docker image to: demisto/xslxwriter:1.0.0.86441.
UnzipFile
- Updated the Docker image to: demisto/unzip:1.0.0.86000.
PcapHTTPExtractor
- Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.85826.
Dig
- Updated the Docker image to: demisto/netutils:1.0.0.86390.
HTMLtoMD
- Updated the Docker image to: demisto/btfl-soup:1.0.1.86352.
JsonUnescape
- Updated the Docker image to: demisto/python3-deb:3.10.13.85666.
GetDomainDNSDetails
- Updated the Docker image to: demisto/netutils:1.0.0.86390.
Ping
- Updated the Docker image to: demisto/netutils:1.0.0.86390.
ParseHTMLIndicators
- Updated the Docker image to: demisto/bs4-tld:1.0.0.86470.
ConvertXmlFileToJson
- Updated the Docker image to: demisto/xml-feed:1.0.0.86490.
ExtractHTMLTables
- Updated the Docker image to: demisto/bs4-py3:1.0.0.86348.
WordTokenizer
- Updated the Docker image to: demisto/nltk:2.0.0.86396.
- 32938
- 32763
- 32762
- 32741
- 32744
- 32745
- 32752
- 32753
- 32754
- 32759
- 32761
Download
Scripts
GetIndicatorDBotScoreFromCache
- Fixed an issue where the GetIndicatorDBotScoreFromCache automation failed when no IOCs were returned from the cache.
- Updated the Docker image to demisto/python3:3.10.13.86272.
CompareLists
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SSDeepReputation
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IsInternalDomainName
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ListUsedDockerImages
- Updated the Docker image to: demisto/python3:3.10.13.86272.
FilterByList
- Updated the Docker image to: demisto/python3:3.10.13.86272.
GenerateRandomUUID
- Updated the Docker image to: demisto/python3:3.10.13.86272.
NumberOfPhishingAttemptPerUser
- Updated the Docker image to: demisto/python3:3.10.13.86272.
DockerHardeningCheck
- Updated the Docker image to: demisto/python3:3.10.13.86272.
HttpV2
- Updated the Docker image to: demisto/python3:3.10.13.86272.
- 32445
Download
Scripts
DecodeMimeHeader
- Updated the Docker image to: demisto/python3:3.10.13.86272.
DisableUserWrapper
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ParseYAML
- Updated the Docker image to: demisto/python3:3.10.13.86272.
GetInstances
- Updated the Docker image to: demisto/python3:3.10.13.86272.
PrettyPrint
- Updated the Docker image to: demisto/python3:3.10.13.86272.
Base64EncodeV2
- Updated the Docker image to: demisto/python3:3.10.13.86272.
DisplayHTML
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SetByIncidentId
- Updated the Docker image to: demisto/python3:3.10.13.86272.
LookupCSV
- Updated the Docker image to: demisto/python3:3.10.13.86272.
FeedRelatedIndicatorsWidget
- Updated the Docker image to: demisto/python3:3.10.13.86272.
URLSSLVerification
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ArrayToCSV
- Updated the Docker image to: demisto/python3:3.10.13.86272.
TimeStampCompare
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IsListExist
- Updated the Docker image to: demisto/python3:3.10.13.86272.
MaliciousRatioReputation
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SetMultipleValues
- Updated the Docker image to: demisto/python3:3.10.13.86272.
DomainReputation
- Updated the Docker image to: demisto/python3:3.10.13.86272.
DumpJSON
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SearchIndicator
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CheckFieldValue
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IdentifyAttachedEmail
- Updated the Docker image to: demisto/python3:3.10.13.86272.
TopMaliciousRatioIndicators
- Updated the Docker image to: demisto/python3:3.10.13.86272.
GetLicenseID
- Updated the Docker image to: demisto/python3:3.10.13.86272.
Strings
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CheckSenderDomainDistance
- Updated the Docker image to: demisto/python3:3.10.13.86272.
HTTPListRedirects
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ConvertTimezoneFromUTC
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SetWithTemplate
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CheckIndicatorValue
- Updated the Docker image to: demisto/python3:3.10.13.86272.
RunPollingCommand
- Updated the Docker image to: demisto/python3:3.10.13.86272.
AddKeyToList
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ResolveShortenedURL
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ExtractAttackPattern
- Updated the Docker image to: demisto/python3:3.10.13.86272.
BreachConfirmationHTML
- Updated the Docker image to: demisto/python3:3.10.13.86272.
PortListenCheck
- Updated the Docker image to: demisto/python3:3.10.13.86272.
JSONtoCSV
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ParseCSV
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CalculateEntropy
- Updated the Docker image to: demisto/python3:3.10.13.86272.
CreateHash
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SendEmailOnSLABreach
- Updated the Docker image to: demisto/python3:3.10.13.86272.
Base64ListToFile
- Updated the Docker image to: demisto/python3:3.10.13.86272.
PositiveDetectionsVSDetectionEngines
- Updated the Docker image to: demisto/python3:3.10.13.86272.
MatchRegexV2
- Updated the Docker image to: demisto/python3:3.10.13.86272.
RunDockerCommand
- Updated the Docker image to: demisto/python3:3.10.13.86272.
GetEntries
- Updated the Docker image to: demisto/python3:3.10.13.86272.
JSONFileToCSV
- Updated the Docker image to: demisto/python3:3.10.13.86272.
cveReputationV2
- Updated the Docker image to: demisto/python3:3.10.13.86272.
RepopulateFiles
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SearchIncidentsSummary
- Updated the Docker image to: demisto/python3:3.10.13.86272.
StopScheduledTask
- Updated the Docker image to: demisto/python3:3.10.13.86272.
IsolationAssetWrapper
- Updated the Docker image to: demisto/python3:3.10.13.86272.
RemoveKeyFromList
- Updated the Docker image to: demisto/python3:3.10.13.86272.
VerifyIPv6Indicator
- Updated the Docker image to: demisto/python3:3.10.13.86272.
ReadFile
- Updated the Docker image to: demisto/python3:3.10.13.86272.
SetTime
- Updated the Docker image to: demisto/python3:3.10.13.86272.
- 32408
Download
Scripts
New: VerdictResult
New: This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field.
ParseEmailFilesV2
- Fixed a parsing issue when running on msg email files with headers only.
- Fixed an issue where EML multipart files were not parsed if they have a broken boundary.
- Updated the Docker image to: demisto/parse-emails:1.0.0.83945.
- 31683
Download
PUBLISHER
PLATFORMS
INFO
Certification | Certified | Read more |
Supported By | Cortex | |
Created | July 27, 2020 | |
Last Release | December 19, 2024 |