Common Scripts

Details
Content
Dependencies
Version History

Download With Dependencies

Frequently used scripts pack.

Pack Contributors:

barpec12

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Pack Contributors:

barpec12

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Automations

Name	Description
GetByIncidentId	Gets a value from the specified incident's context.
ContextContains	This script searches for a value in a context path.
ExtractDomainFromUrlAndEmail	Extract Domain(s) from URL(s) and/or Email(s).
GetFieldsByIncidentType	Returns the incident field names associated to the specified incident type.
IsValueInArray	Indicates whether a given value is a member of given array
ArrayToCSV	Converts a simple Array into a textual comma separated string
SetByIncidentId	Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument. Sets a value into the context with the given context key. Doesn't append by default. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
LookupCSV	Parses a CSV and looks for a specific value in a specific column, returning a dict of the entire matching row. If no column value is specified, the entire CSV is read into the context.
CalculateTimeDifference	Calculate the time difference, in minutes
GetIndicatorDBotScoreFromCache	Get the overall score for the indicator as calculated by DBot.
ResolveShortenedURL	This script resolves the original URL from a given shortened URL and places the resolved URL in the playbook context and output.
VerifyJSON	Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet.
CheckSenderDomainDistance	Get the string distance for the sender from our domain
ShowOnMap	Returns a map entry with a marker on the given coordinates (lat,lng), or address (requires a configured GoogleMaps instance).
EmailAskUser	Ask a user a question via email and process the reply directly into the investigation.
GetEntries	Collect entries matching to the conditions in the war room.
IPReputation	A context script for IP entities.
ContextFilter	Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it.
ContentPackInstaller	Content packs installer from marketplace.
emailFieldTriggered	Sends email to incident owner when selected field is triggered.
FileToBase64List	Encode a file as base64 and store it in a Demisto list.
IsUrlPartOfDomain	Checks if the supplied URLs are in the specified domains.
IsIPInRanges	Returns yes if the IP is in one of the ranges provided, returns no otherwise.
SetTime	Fill the current time in a custom incident field
RemoteExec	Execute a command on a remote machine (without installing a D2 agent)
ConvertTimezoneFromUTC	Takes UTC and converts it to the specified timezone. Format must match the UTC date's format and output will be the same format. Can use in conjunction with ConvertDateToString
GenerateAsBuilt	Generate an as built document, as HTML, based on the running XSOAR instance. Requires an instance of the Demisto API integration configured.
ExportContextToJSONFile	Exports the Context for the current Incident to a JSON file in the war room.
ParseYAML	Parses a YAML string into context.
DeleteContext	Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ExtractIndicatorsFromWordFile	Used to extract indicators from Word files (DOC, DOCX). The script does not extract data from macros (e.g., embedded code). This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GenerateRandomUUID	Generates a random UUID (UUID 4).
GenericPollingScheduledTask	Runs the polling command repeatedly, completes a blocking manual task when polling is done.
IncidentFields	Returns a dict of all incident fields that exist in the system.
FailedInstances	Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances.
GetErrorsFromEntry	Get the error(s) associated with a given entry/entries. Use ${lastCompletedTaskEntries} to check the previous task entries. The automation will return an array of the error contents from those entries.
ExtractIndicatorsFromTextFile	Extract indicators from a text-based file. Indicators that can be extracted: IP Domain URL File Hash Email Address This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
displayUtilitiesResults	This script displays the execution results of the tab's buttons in an HTML table format.
ParseCSV	This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context.
ExtractFQDNFromUrlAndEmail	Extracts FQDNs from URLs and emails.
GenerateRandomString	Generates random string
StringLength	Returns the length of the string passed as argument
AddEvidence	Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)
SetGridField	Creates a Grid table from items or key-value pairs.
UnEscapeIPs	Remove escaping chars from IP 127[.]0[.]0[.]1 -> 127.0.0.1
LinkIncidentsWithRetry	Use this script to avoid DB version errors when simultaneously running multiple linked incidents.
CEFParser	Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields.
CreateNewIndicatorsOnly	Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
StopScheduledTask	This stops the scheduled task whose ID is given in the taskID argument.
VerifyCIDR	Verify that the CIDRs are valid.
StringSimilarity	This automation calculates the similarity ratio between every string in 2 different arrays and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common).
MatchRegexV2	Extracts regex data from the provided text. The script support groups and looping.
MarkAsEvidenceByTag	Mark entries as evidence if they are tagged with given tag
SendEmailOnSLABreach	Sends an email informing the user of an SLA breach. The email is sent to the user who is assigned to the incident. It includes the incident name, ID, name of the SLA field that was breached, duration of that SLA field, and the date and time when that SLA was started. In order to run successfully, the script should be configured to trigger on SLA breach, through field edit mode.
GetDomainDNSDetails	Returns DNS details for a domain.
AppendindicatorFieldWrapper	A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators. Note: You can use this script in an incident Layout button to allow tags to be added to indicators through the incident.
ConvertFile	Converts a file from one format to a different format by using the convert-to function of Libre Office. For a list of supported input/output formats see: https://wiki.openoffice.org/wiki/Framework/Article/Filter/FilterList_OOo_3_0
NotInContextVerification	Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution.
PortListenCheck	Checks whether a port was open on given host.
GenerateSummaryReports	Generate report summaries for the passed incidents.
AquatoneDiscoverV2	aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery.
GetListRow	Parses a list by header and value.
GeneratePassword	This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of random length including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. The min_* values all default to 0. This means that if the command is executed in this way: !GeneratePassword max_lcase=10 It is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches. The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics.
hideFieldsOnNewIncident	When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode.
FindSimilarIncidents	Deprecated. Use DBotFindSimilarIncidents instead. Finds similar incidents by common incident keys, labels, custom fields or context keys. It's highly recommended to use incident keys if possible (e.g., "type" for the same incident type). For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label). This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetDuplicatesMlv2	Deprecated. Use the "PhishingDedupPreprocessingRule" script instead. Find duplicate incidents candidates. Using machine learning techniques with pre-defined data (can also use data from the local environment), this script takes into consideration different features such as: labels comparison, email labels (relevant for phishing), incident time difference and shared indicators, which can be customized by the arguments. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
Base64Encode	Will encode an input using Base64 format.
FilterByList	Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist.
Ping	Pings an IP or url address, to verify it's up. Note - On Cortex XSOAR 8 and Cortex XSIAM, the script can run only on a custom engine.
CertificateReputation	Enrich and calculate the reputation of a certificate indicator.
ServerLogs_docker	Uses the ssh integration to grab the host server logs.
GetDockerImageLatestTag	Gets docker image latest tag. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with the docker image latest tag if all is good, otherwise will return an error.
ZipStrings	Joins values from two lists by index according to a given format.
ListUsedDockerImages	List all Docker images that are in use by the installed integrations and automations.
SetIndicatorGridField	This script updates an indicator's grid field in Cortex XSOAR with provided row data. You can input the rows directly or extract them from the context.
DockerHardeningCheck	Checks if the Docker container running this script has been hardened according to the recommended settings at: For Docker hardening guide (Cortex XSOAR 6.13) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide For Docker hardening guide (Cortex XSOAR 8 Cloud) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Docker-hardening-guide For Docker hardening guide (Cortex XSOAR 8.7 On-prem) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Docker-hardening-guide.
get-endpoint-data	This script gathers endpoint data from multiple integrations and returns an endpoint entity with consolidated information to the context.
ExifRead	Read image files metadata and provide Exif tags.
MarkAsNoteByTag	Mark entries as notes if they are tagged with given tag.
MapValues	Map the given values to the translated values. If given values: a,b,c and translated: 1,2,3 then input is a will return 1
EmailAskUserResponse	Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply.
ChangeRemediationSLAOnSevChange	Changes the remediation SLA once a change in incident severity occurs. This is done automatically and the changes can be configured to your needs.
FileReputation	A context script for hash entities.
FileCreateAndUpload	Deprecated. Use FileCreateAndUploadV2 instead. Will create a file (using the given data input or entry ID) and upload it to current investigation war room.
DBotClosedIncidentsPercentage	Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts.
PrintErrorEntry	Prints an error entry with a given message.
VerifyIPv6Indicator	Verify that the address is a valid IPv6 address.
ExportToCSV	Export given array to csv file.
IsListExist	Check if list exist in demisto lists.
GenerateInvestigationSummaryReport	A script to generate investigation summary report in an automated way Can be used in post-processing flow as well.
commentsToContext	Takes the comments of a given entry ID and stores them in the incident context, under a provided context key. For accessing the last executed task's comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId input parameter.
GetDataCollectionLink	Generates the URL for a Data Collection Task into Context. Can be used to get the url for tasks send via Email, Slack, or even if you select "By Task Only". To generate links for specific users, add an array of users in the users argument.
HTTPListRedirects	List the redirects for a given URL
ReadPDFFileV2	Load a PDF file's content and metadata into context. Supports extraction of hashes, urls, and emails when available.
Dig	DNS lookup utility to provide 'A' and 'PTR' record.
ConvertXmlToJson	Converts XML string to JSON format
Base64ListToFile	Converts Base64 file in a list to a binary file and upload to warroom
IndicatorMaliciousRatioCalculation	Return indicators appears in resolved incidents, and resolved incident ids. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
BreachConfirmationHTML
ReadQRCode	Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code.
MaliciousRatioReputation	Set indicator reputation to "suspicious" when malicious ratio is above threshold. Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.
CreateIndicatorsFromSTIX	Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.x. This automation creates indicators and adds an indicator's relationships if available.
ScheduleGenericPolling	Called by the GenericPolling playbook, schedules the polling task.
CreateArray	Will create an array object in context from given string input
LinkIncidentsButton	Incident action button script to link or unlink Incidents from an Incident
RemoveKeyFromList	Removes a key in key/value store backed by an XSOAR list.
GridFieldSetup	Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. Instead of a value you can enter `TIMESTAMP` to get the current timestamp in ISO format. For example: `!GridFieldSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" gridfiled="gridfield"`.
ShowLocationOnMap	Show indicator geo location on map.
http	Sends http request. Returns the response as json.
ExposeIncidentOwner	Expose the incident owner into IncidentOwner context key
DBotAverageScore	The script calculates the average DBot score for each indicator in the context.
SCPPullFiles	Take a list of devices and pull a specific file (given by path) from each using SCP.
PCAPMiner	Deprecated. Use PCAPMinerV2 instead. PCAPMiner is a tool to parse PCAP files and will return things like extracted files that are found, HTTP flows, and a variety of other information. It is uses a docker instance located on docker hub trorabaugh/dempcap:1.0. To use simply upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry id click on the link on the top right hand corner of a file attachment.
UtilAnyResults	Utility script to use in playbooks - returns "yes" if the input is non-empty.
IsTrue	Check if a given value is true. Will return 'no' otherwise
DecodeMimeHeader	Decode MIME base64 headers.
IsGreaterThan	Checks if one number(float) as bigger than the other(float) Returns yes: if first > second Returns no: if first <= second Returns exception if one of the inputs is not a number
Print	Prints text to war room (Markdown supported)
SearchIndicator	Searches Cortex XSOAR Indicators. Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument.
FeedRelatedIndicatorsWidget	Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant.
ChangeContext	Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values.
URLReputation	A context script for URL entities.
displayMappedFields	Display the mapped fields in a dynamic-section.
AddDBotScoreToContext	Add DBot score to context for indicators with custom vendor, score, reliability, and type.
ExtractHyperlinksFromOfficeFiles	Extracts hyperlinks from office files. Supported file types are: xlsx, docx, pptx.
WordTokenizer	Deprecated. Use DBotPreProcessTextData instead.
StringReplace	Replaces regex match/es in string. Returns the string after replace was preformed.
PDFUnlocker	Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF.
IncidentAddSystem	Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system)
CloseInvestigationAsDuplicate	Close the current investigation as duplicate to other investigation.
NumberOfPhishingAttemptPerUser	Shows a bar chart of the number of incident the 'To' and 'From' email addresses. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CreateHash	Creating a hash of a given input, support sha1, sha256, sha512, md5 and blake. Wrapper for https://docs.python.org/3/library/hashlib.html.
IsMaliciousIndicatorFound	Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.
ShowScheduledEntries	Show all scheduled entries for specific incident.
LessThanPercentage	Checks if one percentage is less than another Returns less: if firstPercentage < secondPercentage Returns more: if firstPercentage >= secondPercentage Returns exception if one of the inputs is not a float
IsEmailAddressInternal	Checks if the email address is part of the internal domains.
HTMLtoMD	Converts HTML to Markdown.
JSONDiff	compares two JSON files and returns their differences, such as added, removed, or changed fields, in a structured format.
DisplayHTMLWithImages	Display HTML with embedded images.
GetIndicatorDBotScore	Add into the incident's context the system internal DBot score for the input indicator.
ParseEmailFiles	Deprecated. Use ParseEmailFilesV2 instead." Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook.
TextFromHTML	Extract regular text from the given HTML.
IsIPPrivate	The script takes one or more IP addresses and checks whether they're in the private IP ranges defined in the PrivateIPsListName argument. By default, the PrivateIPsListName argument will use the Cortex XSOAR list called "PrivateIPs". The list can be modified, and by default uses the ranges defined by the Internet Assigned Numbers Authority (IANA). The following are the default CIDR ranges for private IPv4 addresses: 10.0.0.0/8 (range: 10.0.0.0 to 10.255.255.255) 172.16.0.0/12 (range: 172.16.0.0 to 172.31.255.255) 192.168.0.0/16 (range: 192.168.0.0 to 192.168.255.255) In addition to ranges, it's also possible to add specific IP addresses to the list. You may also tag IPs or IP ranges by adding a comma after the IP or range, and then adding the tag that you want to tag the corresponding IP indicators with.
DisplayHTML	Display HTML in the War Room.
IsIntegrationAvailable	Returns 'yes' if integration brand is available. Otherwise returns 'no'.
SetAndHandleEmpty	Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
OnionURLReputation	This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.
CertificateExtract	Extract fields from a certificate file and return the standard context.
MITRENameByID_Formatter	Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).
SendMessageToOnlineUsers	Send message to Demisto online users over Email, Slack, Mattermost or all.
SSDeepReputation	Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system.
ticksToTime	Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft.
UnPackFile	Deprecated. Use the UnzipFile script instead. UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context. supported types are: 7z (.7z), ACE (.ace), ALZIP (.alz), AR (.a), ARC (.arc), ARJ (.arj), BZIP2 (.bz2), CAB (.cab), compress (.Z), CPIO (.cpio), DEB (.deb), DMS (.dms), GZIP (.gz), LRZIP (.lrz), LZH (.lha, .lzh), LZIP (.lz), LZMA (.lzma), LZOP (.lzo), RPM (.rpm), RAR (.rar), RZIP (.rz), TAR (.tar), XZ (.xz), ZIP (.zip, .jar) and ZOO (.zoo)
cvss_color	This dynamic automation parses the CVSS score of a CVE and presents it in the layout in color according to its score.
LanguageDetect	Language detection based on Google's language-detection.
SearchIncidentsSummary	Searches Cortex XSOAR Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient.
ExportToXLSX	Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file.
Base64EncodeV2	Encodes an input to Base64 format.
IncreaseIncidentSeverity	Optionally increases the incident severity to the new value if it is greater than the existing severity.
DownloadAndArchivePythonLibrary	The script downloads a Python library using PIP, archives it, and returns the file to the war room.
ZipFile	Zip a file and upload to war room.
ExportAuditLogsToFile	Uses the Core REST API integration to query the server audit trail logs, and return back a CSV or JSON file.
CompareLists	Compare two lists and put the differences in context.
ServerLogs	Uses the ssh integration to grab the host server logs.
PcapHTTPExtractor	Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.
TopMaliciousRatioIndicators	Find the top malicious ratio indicators. Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.
CheckIndicatorValue	Check if indicators exist in the Threat Intel database.
UnEscapeURLs	Extract URLs redirected by security tools like Proofpoint. Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com
VerdictResult	This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field.
PrintContext	Pretty-print the contents of the playbook context.
ConvertTableToHTML	Converts a given array to an HTML table
ConvertCountryCodeCountryName	Convert country name to country code or country code to country name. Only one of 'country_code' or 'country_name' can be provided. Example: Input: { "country_code": "US" } Output: { "United States" } Another Example: Input: { "country_name": "United States" } Output: { "US" }.
EmailDomainSquattingReputation	Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm.
checkValue	Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly. If an array is returned. the first value will be the decision making value.
JSONtoCSV	Convert a JSON War Room output via EntryID to a CSV file.
Set	Set a value in context under the key you entered.
ParseExcel	The automation takes Excel file (entryID) as an input and parses its content to the war room and context.
LoadJSONFileToContext	Loads a JSON file from the war room to context.
RepopulateFiles	After running DeleteContext, this script can repopulate all the file entries in the ${File} context key
TimeStampCompare	Compares a single timestamp to a list of timestamps.
ContextGetHashes	Gets hashes (MD5,SHA1,SHA256) from context.
RunDockerCommand	This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container. We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context.
GetServerURL	Get the Server URL.
URLNumberOfAds	Fetches the numbers of ads in the given url.
CopyContextToField	Copy a context key to an incident field of multiple incidents, based on an incident query. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
URLSSLVerification	Verify URL SSL certificate.
CVSSCalculator	This script calculates the CVSS Base Score, Temporal Score, and Environmental Score using either the CVSS 3.0 or CVSS 3.1 calculator according to https://www.first.org/cvss/ calculation documentation.
DisableUserWrapper	This script allows disabling a specified user using one or more of the following integrations: SailPointIdentityIQ, ActiveDirectoryQuery, Okta, MicrosoftGraphUser, and IAM.
ExtractAttackPattern	Extract Attack Pattern Threat Intel Object. After auto extract extracts the Attack Pattern IDs, this script is executed and extracts the value (name) of the Attack Pattern.
AssignAnalystToIncident	Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users). Otherwise, the analyst will be picked according to the 'assignBy' arguments. machine-learning: DBot will calculated and decide who is the best analyst for the job. top-user: The user that is most commonly owns this type of incident less-busy-user: The less busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users). current: The user that executed the command.
AreValuesEqual	Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
JSONFileToCSV	Script to convert a War Room output JSON File to a CSV file.
StopTimeToAssignOnOwnerChange	Stops the "Time To Assign" timer if the owner of the incident was changed.
ExportIndicatorsToCSV	This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.
BinarySearchPy	Deprecated. No available replacement. Search for a binary on an endpoint using Carbon Black
ExtractEmailV2	Verifies that an email address is valid and only returns the address if it is valid.
SSDeepSimilarity	This script finds similar files that can be related to each other by fuzzy hash (SSDeep).
GenerateSummaryReportButton	This button will generate summary 'Case Report' template for a given Incident
DumpJSON	Dumps a json from context key input, and returns a json object string result
FetchIndicatorsFromFile	Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types.
IsInternalDomainName	This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain.
clear-user-session	This script clears user sessions across multiple integrations for a list of usernames.
GetStringsDistance	Get the string distance between inputString and compareString (compareString can be a comma-separated list) based on Levenshtein Distance algorithm.
RunPollingCommand	Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
DemistoVersion	Return the Demisto server version.
IdentifyAttachedEmail	Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.
AddKeyToList	Adds/Replaces a key in key/value store backed by an XSOAR list.
CompareIncidentsLabels	Compares the labels of two incidents. Returns the labels that are unique to each incident. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SetWithTemplate	Set a value built by a template in context under the key you entered.
IsolationAssetWrapper	This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex XSOAR 6.0.0).
ToTable	Convert an array to a nice table display. Usually, from the context.
GetLicenseID	Returns the license ID.
DeduplicateValuesbyKey	Given a list of objects and a key found in each of those objects, return a unique list of values associated with that key. Returns error if the objects provided do not contain the key of interest.
ConvertDatetoUTC	Converts a date from a different timezone to UTC timezone.
PrintRaw	Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression.
CheckFieldValue	This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value.
EditServerConfig	Edit the server configuration (under settings/troubleshooting). You can either add a new configuration or update and remove an existing one.
CommandLineAnalysis	This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows: 0-25: Low Risk 26-50: Medium Risk 51-90: High Risk 91-100: Critical Risk The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.
findIncidentsWithIndicator	Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
AssignToMeButton	Assigns the current Incident to the Cortex XSOAR user who clicked the button
Sleep	Sleep for X seconds.
ExtractDomainAndFQDNFromUrlAndEmail	Extracts domains and FQDNs from URLs and emails.
ParseEmailFilesV2	Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. This script is based on the parse-emails XSOAR python package, check the script documentation for more info.
CalculateEntropy	Calculates the entropy for the given data.
CheckContextValue	This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values.
ReadFile	Load the contents of a file into context.
ShowIncidentIndicators	This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL. This script is a field-display script, so it needs to be configured as such, when editing the incident field that will be used to display the indicators.
PositiveDetectionsVSDetectionEngines	Shows a bar chart of the number of Positive Detections out of overall detections
CountArraySize	Count an array size
ExampleJSScript	This is only an example script, to showcase how to use and write JavaScript scripts
ContainsCreditCardInfo	Check if a given value is true. Will return 'no' otherwise
FormatURL	Strips, unquotes and unescapes URLs. If the URL is a Proofpoint or ATP URL, extracts its redirect URL. If more than one URL is passed to the formatter, the separator must be a pipe ("\|").
MathUtil	Script will run the provided mathematical action on 2 provided values and produce a result. The result can be stored on the context using the contextKey argument
StixCreator	Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format.
ContextGetEmails	Gets all email addresses in context, excluding ones given.
MatchRegex	Deprecated. Use the MatchRegexV2 script instead.
isError	Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error.
IsPDFFileEncrypted	Checks whether the PDF file is encrypted.
get-user-data	This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context.
FileCreateAndUploadV2	Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room.
cveReputationV2	Provides the severity of the CVE based on the CVSS score where available.
SetMultipleValues	Set multiple keys/values to the context.
HttpV2	Sends a HTTP request with advanced capabilities.
ReplaceMatchGroup	Returns a string with all matches of a regex pattern groups replaced by a replacement.
EncodeToAscii	Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII)
ExportIncidentsToCSV	This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room.
PrettyPrint	Pretty-print data using Python's pprint library. This is useful for seeing the structure of incident and context data. Here's how to use it: !PrettyPrint value=${incident}
SetDateField	Sets a custom incident field with current date
CopyNotesToIncident	Copy all entries marked as notes from current incident to another incident.
PreProcessImage	This script pre-processes (resizes, sharpens, and grayscales) an image file from context, given an entry_id.
IsInternalHostName	Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix.
GetTime	Retrieves the current date and time.
MarkRelatedIncidents	Marks given incidents as related to current incident. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
Exists	Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
ContextGetIps	Gets all IP addresses in context, excluding ones given.
PopulateCriticalAssets	Populates critical assets in a grid field that has the section headers "Asset Type" and "Asset Name".
listExecutedCommands	Lists executed commands in War Room
enrich_exclude_button	This script is only meant to be used to disable the Enrich Excluded button in an indicator. It should not be used otherwise.
EmailReputation	A context script for Email entities.
SearchIncidentsV2	Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
ContextSearchForString	Searches for string in a path in context. If path is null, string will be searched in full context.
PublishEntriesToContext	Publish entries to incident's context
GetInstances	Returns integration instances configured in Cortex XSOAR. You can filter by instance status and/or brand name (vendor).
Strings	Extract strings from a file with optional filter - similar to binutils strings command
UnzipFile	Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context.
ProvidesCommand	Finds which integrations implement a specific Demisto command. The results will be returned as comma-separated values (CSV). The "Core REST API" integration must first be enabled.
LoadJSON	Loads a json from string input, and returns a json object result.
ScheduleCommand	Schedule a command to run inside the war room at a future time (once or reoccurring)
GetEnabledInstances	Gets all currently enabled integration instances.
BMCTool	Parse RDP bitmap cache data into a single collage image file.
IPNetwork	Gather information regarding CIDR - 1. Broadcast_address 2. CIDR 3. First_address 4. Last address 5. Max prefix len 6. Num addresses 7. Private 8. Version.
CreateEmailHtmlBody	This script allows sending an HTML email, using a template stored as a list item under Lists (Settings -> Advanced -> Lists). Placeholders are marked in DT format (i.e. ${incident.id} for incident ID). Available placeholders for example: ${incident.labels.Email/from} ${incident.name} ${object.value} See incident Context Data menu for available placeholders Note: Sending emails require an active Mail Sender integration instance.
ContextGetPathForString	Searches for string in context and returns context path, returns null if not found.
ParseWordDoc	Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents.
DomainReputation	A context script for Domain entities
ConvertXmlFileToJson	Converts XML file entry to JSON format
ExtractHTMLTables	Find tables inside HTML and extract the contents into objects using the following logic: If table has a single column, just create an array of strings from the values If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value If table has a header row, create a table of objects where attribute names are the headers If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3…
GenerateAsBuiltConfiguration	Generate a JSON file that can be downloaded and used to create the As-Built document for Cortex XSOAR.
ParseHTMLIndicators	This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
JsonUnescape	Recursively un-escapes JSON data if escaped JSON is found
AnalyzeTimestampIntervals	Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps.
IPToHost	Try to get the hostname correlated with the input IP.
IsDomainInternal	The script takes one or more domain names and checks whether they're in the Cortex XSOAR list defined in the InternalDomainsListName argument. By default, the InternalDomainsListName argument will use the Cortex XSOAR list called "InternalDomains". The list can be customized by the user. It should contain the organization's internal domain names, separated by new lines. Subdomains are also supported in the list. The results of the script are tagged with the "Internal_Domain_Check_Results" tag, so they can be displayed in the War Room entry sections in incident layouts.

Incident Fields

Name	Description
Breach Confirmation	Is the DPO confirm the breach
Telephone no.
Size - turnover
State where the breach took place
Individuals Notification
State CISO Notification
Unique identification number breached	Is unique identification number breached
Where is data hosted
Resident Notification Option
Secretary Notification
PII Data Type
Health insurance breached	Is health insurance breached
Management Notification
GDPR Notify Authorities	"In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." - GDPR Art. 33
Affected Individuals Contact Information
Company Name
Country where business has its main establishment	"‘main establishment’ means: as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;" - GDPR Art. 4
Contact Email address
Contact Telephone number
Account information breached	Is account information breached
Attorney General Notification
Unique biometric data breached	Is unique biometric data breached
Date/time of the breach
DPO Notification
Data Encryption Status
Affected Data Type
Company Address
Financial information breached	Is financial information breached
Likely Impact	"A data protection impact assessment (…) shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale. - GDPR Art. 35
Other PII data breached	Is other PII data breached
Media Notification	The status of the media notification
Postal Code
Contact Name
Company Postal Code
Country where the breach took place
Affected data	"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" - GDPR Art. 4
DPO E-mail Address
Consumer Reporting Agencies Notification
Company has Insurance for the Breach
Approximate number of affected data subjects
Is the Data Subject to DPIA
Sector of Affected Party
Measures to Mitigate	" (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects." - GDPR Art. 33
Contact Address
Malicious Cause (If the cause is a malicious attack)
Company City
Company Country
Residents Email Address
E-mail Address
Possible Cause of the Breach
Medical Information breached	Is Medical Information breached
Size - number of employees

Lists

Name	Description
PrivateIPs
InternalDomains

Automations

Name	Description
displayUtilitiesResults	This script displays the execution results of the tab's buttons in an HTML table format.
DeleteContext	Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ContextGetHashes	Gets hashes (MD5,SHA1,SHA256) from context.
findIncidentsWithIndicator	Lookup incidents with specified indicator. Use currentIncidentId to omit the existing incident from output. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
findAlertsWithIndicator	Lookup alerts with specified indicator. Use currentAlertId to omit the existing alert from output. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ExportToXLSX	Exports context data to a Microsoft Excel Open XML Spreadsheet (XLSX) file.
AssignToMeButton	Assigns the current Incident to the Cortex user who clicked the button
SendMessageToOnlineUsers	Send message to Demisto online users over Email, Slack, Mattermost or all.
GeneratePassword	This function generates a password and allows various parameters to customize the properties of the password depending on the use case (e.g. password complexity requirements). The default behavior is to generate a password of random length including all four character classes (upper, lower, digits, symbols) with at least five and at most ten characters per class. The min_* values all default to 0. This means that if the command is executed in this way: !GeneratePassword max_lcase=10 It is possible that a password of length zero could be generated. It is therefore recommended to always include a min_* parameter that matches. The debug parameter will print certain properties of the command into the WarRoom for easy diagnostics.
GetEnabledInstances	Gets all currently enabled integration instances.
SearchIncidentsSummary	Searches Cortex Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient.
SearchAlertsSummary	Searches Cortex Alerts and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchAlertsV2 from the Common Scripts pack, but more efficient.
ShowLocationOnMap	Show indicator geo location on map.
SearchIncidentsV2	Searches Demisto incidents. A summarized version of this scrips is available with the summarizedversion argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
SearchAlertsV2	Searches Demisto alerts. A summarized version of this scrips is available with the summarizedversion argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Automations
LinkIncidentsButton	Incident action button script to link or unlink Incidents from an Incident
LinkAlertsButton	Alert action button script to link or unlink Alerts from an Alert
ContextGetPathForString	Searches for string in context and returns context path, returns null if not found.
PreProcessImage	This script pre-processes (resizes, sharpens, and grayscales) an image file from context, given an entry_id.
ToTable	Convert an array to a nice table display. Usually, from the context.
ParseWordDoc	Takes an input docx file (entryID) as an input and saves an output text file (file entry) with the original file's contents.
BreachConfirmationHTML
SetAndHandleEmpty	Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
EmailReputation	A context script for Email entities.
ExportContextToJSONFile	Exports the Context for the current Incident to a JSON file in the war room.
LoadJSONFileToContext	Loads a JSON file from the war room to context.
EncodeToAscii	Input Text Data to Encode as ASCII (Ignores any chars that aren't interpreted as ASCII)
cvss_color	This dynamic automation parses the CVSS score of a CVE and presents it in the layout in color according to its score.
ExtractFQDNFromUrlAndEmail	Extracts FQDNs from URLs and emails.
http	Sends http request. Returns the response as json.
ScheduleCommand	Schedule a command to run inside the war room at a future time (once or reoccurring)
ReadQRCode	Extracts the text from a QR code. The output of this script includes the output of the script "extractIndicators" run on the text extracted from the QR code.
FindSimilarIncidents	Deprecated. Use DBotFindSimilarIncidents instead. Finds similar incidents by common incident keys, labels, custom fields or context keys. It's highly recommended to use incident keys if possible (e.g., "type" for the same incident type). For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label). This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
FindSimilarAlerts	Deprecated. Use DBotFindSimilarAlerts instead. Finds similar alerts by common alert keys, labels, custom fields or context keys. It's highly recommended to use alert keys if possible (e.g., "type" for the same alert type). For best performance, it's recommended to avoid using context keys if possible (for example, if the value also appears in a label key, use label). This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
DBotClosedIncidentsPercentage	Data output script for populating dashboard pie graph widget with the percentage of incidents closed by DBot vs. incidents closed by analysts.
DBotClosedAlertsPercentage	Data output script for populating dashboard pie graph widget with the percentage of alerts closed by DBot vs. alerts closed by analysts.
ContextGetIps	Gets all IP addresses in context, excluding ones given.
AnalyzeTimestampIntervals	Analyze a list of Unix timestamps in milliseconds, to detect simple patterns of consistency or high frequency. The script can aid in the investigation of multi-event alerts that contain a list of timestamps.
HttpV2	Sends a HTTP request with advanced capabilities.
EmailDomainSquattingReputation	Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm.
Set	Set a value in context under the key you entered.
AppendindicatorFieldWrapper	A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators. Note: You can use this script in an incident Layout button to allow tags to be added to indicators through the incident.
VerdictResult	This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field.
SetWithTemplate	Set a value built by a template in context under the key you entered.
UnzipFile	Unzip a file using fileName or entryID to specify a file. Unzipped files will be loaded to the War Room and names will be put into the context.
FileCreateAndUploadV2	Creates a file (using the given data input or entry ID) and uploads it to the current investigation War Room.
ExportIncidentsToCSV	This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room.
ExportAlertsToCSV	This automation uses the Core REST API Integration to batch export Alerts to CSV and return the resulting CSV file to the war room.
VerifyIPv6Indicator	Verify that the address is a valid IPv6 address.
FetchIndicatorsFromFile	Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types.
EmailAskUser	Ask a user a question via email and process the reply directly into the investigation.
IsInternalDomainName	This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain.
CommandLineAnalysis	This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows: 0-25: Low Risk 26-50: Medium Risk 51-90: High Risk 91-100: Critical Risk The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.
ContentPackInstaller	Content packs installer from marketplace.
AddEvidence	Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)
Exists	Check if a given value exists in the context. Will return 'no' for empty empty arrays. To be used mostly with DQ and selectors.
CheckIndicatorValue	Check if indicators exist in the Threat Intel database.
ReadPDFFileV2	Load a PDF file's content and metadata into context. Supports extraction of hashes, urls, and emails when available.
SetDateField	Sets a custom incident field with current date
AreValuesEqual	Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned.
EditServerConfig	Edit the server configuration (under settings/troubleshooting). You can either add a new configuration or update and remove an existing one.
SearchIndicator	Searches Cortex Indicators. Search for XSOAR Indicators and returns the id, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument.
ExtractDomainFromUrlAndEmail	Extract Domain(s) from URL(s) and/or Email(s).
GenerateInvestigationSummaryReport	A script to generate investigation summary report in an automated way Can be used in post-processing flow as well.
MathUtil	Script will run the provided mathematical action on 2 provided values and produce a result. The result can be stored on the context using the contextKey argument
DisplayHTML	Display HTML in the War Room.
FileCreateAndUpload	Deprecated. Use FileCreateAndUploadV2 instead. Will create a file (using the given data input or entry ID) and upload it to current investigation war room.
CreateHash	Creating a hash of a given input, support sha1, sha256, sha512, md5 and blake. Wrapper for https://docs.python.org/3/library/hashlib.html.
FailedInstances	Executes a test for all integration instances available and returns detailed information about succeeded and failed integration instances.
ExtractHyperlinksFromOfficeFiles	Extracts hyperlinks from office files. Supported file types are: xlsx, docx, pptx.
IPReputation	A context script for IP entities.
ExifRead	Read image files metadata and provide Exif tags.
GetLicenseID	Returns the license ID.
commentsToContext	Takes the comments of a given entry ID and stores them in the incident context, under a provided context key. For accessing the last executed task's comments, provide ${lastCompletedTaskEntries.[0]} as the value for the entryId input parameter.
JsonUnescape	Recursively un-escapes JSON data if escaped JSON is found
GridFieldSetup	Automation used to more easily populate a grid field. This is necessary when you want to assign certain values as static or if you have context paths that you will assign to different values as well. Instead of a value you can enter `TIMESTAMP` to get the current timestamp in ISO format. For example: `!GridFieldSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" gridfiled="gridfield"`.
CalculateTimeDifference	Calculate the time difference, in minutes
StixCreator	Gets a list of indicators from the indicators argument, and generates a JSON file in STIX 2.1 format.
SetMultipleValues	Set multiple keys/values to the context.
MatchRegex	Deprecated. Use the MatchRegexV2 script instead.
IsListExist	Check if list exist in demisto lists.
PrintToAlert	Prints a value to the specified alert's war-room. The alert must be in status "Under Investigation".
IsInternalHostName	Checks if the supplied hostnames match either the organization's internal naming convention or the domain suffix.
JSONDiff	compares two JSON files and returns their differences, such as added, removed, or changed fields, in a structured format.
DomainReputation	A context script for Domain entities
Sleep	Sleep for X seconds.
IncidentAddSystem	Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system)
AlertAddSystem	Add a remote system (such as a desktop under investigation) to an investigation (this will allow you to install and agent on the system)
MarkAsNoteByTag	Mark entries as notes if they are tagged with given tag.
PCAPMiner	Deprecated. Use PCAPMinerV2 instead. PCAPMiner is a tool to parse PCAP files and will return things like extracted files that are found, HTTP flows, and a variety of other information. It is uses a docker instance located on docker hub trorabaugh/dempcap:1.0. To use simply upload a PCAP file and then run PCAPMiner entryId="<your_entry_id>". To get the entry id click on the link on the top right hand corner of a file attachment.
FilterByList	Checks whether the specified item is in a list. The default list is the Demisto Indicators Whitelist.
GenerateSummaryReports	Generate report summaries for the passed incidents.
CopyContextToField	Copy a context key to an incident field of multiple incidents, based on an incident query. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetServerURL	Get the Server URL.
MatchRegexV2	Extracts regex data from the provided text. The script support groups and looping.
GetDockerImageLatestTag	Gets docker image latest tag. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with the docker image latest tag if all is good, otherwise will return an error.
ExampleJSScript	This is only an example script, to showcase how to use and write JavaScript scripts
ExportAuditLogsToFile	Uses the Core REST API integration to query the server audit trail logs, and return back a CSV or JSON file.
ServerLogs_docker	Uses the ssh integration to grab the host server logs.
GetEntries	Collect entries matching to the conditions in the war room.
IsGreaterThan	Checks if one number(float) as bigger than the other(float) Returns yes: if first > second Returns no: if first <= second Returns exception if one of the inputs is not a number
Base64ListToFile	Converts Base64 file in a list to a binary file and upload to warroom
ContextFilter	Filter context keys by applying one of the various available manipulations and storing in a new context key. Please notice that the resulting context key will not be available automatically as an option but you can still specify it.
PortListenCheck	Checks whether a port was open on given host.
clear-user-session	This script clears user sessions across multiple integrations for a list of usernames.
ZipFile	Zip a file and upload to war room.
ContextSearchForString	Searches for string in a path in context. If path is null, string will be searched in full context.
RemoteExec	Execute a command on a remote machine (without installing a D2 agent)
TopMaliciousRatioIndicators	Find the top malicious ratio indicators. Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.
EmailAskUserResponse	Extract user's response from EmailAskUser reply. Returns the first textual response line of the provided entry that contains the reply body. Use ${lastCompletedTaskEntries} to analyze the previous playbook task containing the user's reply.
CompareIncidentsLabels	Compares the labels of two incidents. Returns the labels that are unique to each incident. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CompareAlertsLabels	Compares the labels of two alerts. Returns the labels that are unique to each alert. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
MapValues	Map the given values to the translated values. If given values: a,b,c and translated: 1,2,3 then input is a will return 1
ParseEmailFilesV2	Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook. This script is based on the parse-emails XSOAR python package, check the script documentation for more info.
AddDBotScoreToContext	Add DBot score to context for indicators with custom vendor, score, reliability, and type.
GenerateSummaryReportButton	This button will generate summary 'Case Report' template for a given Incident
ArrayToCSV	Converts a simple Array into a textual comma separated string
MarkAsEvidenceByTag	Mark entries as evidence if they are tagged with given tag
URLSSLVerification	Verify URL SSL certificate.
VerifyCIDR	Verify that the CIDRs are valid.
PrettyPrint	Pretty-print data using Python's pprint library. This is useful for seeing the structure of incident and context data. Here's how to use it: !PrettyPrint value=${incident}
IdentifyAttachedEmail	Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.
LanguageDetect	Language detection based on Google's language-detection.
AssignAnalystToIncident	Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users). Otherwise, the analyst will be picked according to the 'assignBy' arguments. machine-learning: DBot will calculated and decide who is the best analyst for the job. top-user: The user that is most commonly owns this type of incident less-busy-user: The less busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users). current: The user that executed the command.
IPNetwork	Gather information regarding CIDR - 1. Broadcast_address 2. CIDR 3. First_address 4. Last address 5. Max prefix len 6. Num addresses 7. Private 8. Version.
CountArraySize	Count an array size
CalculateEntropy	Calculates the entropy for the given data.
Ping	Pings an IP or url address, to verify it's up. Note - On Cortex and Cortex XSIAM, the script can run only on a custom engine.
CreateEmailHtmlBody	This script allows sending an HTML email, using a template stored as a list item under Lists (Settings -> Advanced -> Lists). Placeholders are marked in DT format (i.e. ${incident.id} for incident ID). Available placeholders for example: ${incident.labels.Email/from} ${incident.name} ${object.value} See incident Context Data menu for available placeholders Note: Sending emails require an active Mail Sender integration instance.
HTTPListRedirects	List the redirects for a given URL
RunPollingCommand	Runs a specified polling command one time. This is useful for initiating a local playbook context before running a polling scheduled task. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ScheduleGenericPolling	Called by the GenericPolling playbook, schedules the polling task.
SetByIncidentId	Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument. Sets a value into the context with the given context key. Doesn't append by default. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SetByAlertId	Works the same as the 'Set' command, but can work across alerts by specifying 'id' as an argument. Sets a value into the context with the given context key. Doesn't append by default. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
UtilAnyResults	Utility script to use in playbooks - returns "yes" if the input is non-empty.
ZipStrings	Joins values from two lists by index according to a given format.
NumberOfPhishingAttemptPerUser	Shows a bar chart of the number of incident the 'To' and 'From' email addresses. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetErrorsFromEntry	Get the error(s) associated with a given entry/entries. Use ${lastCompletedTaskEntries} to check the previous task entries. The automation will return an array of the error contents from those entries.
ConvertXmlFileToJson	Converts XML file entry to JSON format
PcapHTTPExtractor	Allows to parse and extract http flows (requests & responses) from a pcap/pcapng file.
LoadJSON	Loads a json from string input, and returns a json object result.
ShowIncidentIndicators	This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL. This script is a field-display script, so it needs to be configured as such, when editing the incident field that will be used to display the indicators.
ShowAlertIndicators	This script is used to display the indicators of an alert in an alert field of type Array. It can be used to select indicators from the alert in order to later perform some actions, like tagging the indicators for blocking via EDL. This script is a field-display script, so it needs to be configured as such, when editing the alert field that will be used to display the indicators.
ParseHTMLIndicators	This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
JSONtoCSV	Convert a JSON War Room output via EntryID to a CSV file.
DeduplicateValuesbyKey	Given a list of objects and a key found in each of those objects, return a unique list of values associated with that key. Returns error if the objects provided do not contain the key of interest.
get-user-data	This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context.
CloseInvestigationAsDuplicate	Close the current investigation as duplicate to other investigation.
SetTime	Fill the current time in a custom incident field
ConvertXmlToJson	Converts XML string to JSON format
LessThanPercentage	Checks if one percentage is less than another Returns less: if firstPercentage < secondPercentage Returns more: if firstPercentage >= secondPercentage Returns exception if one of the inputs is not a float
get-endpoint-data	This script gathers endpoint data from multiple integrations and returns an endpoint entity with consolidated information to the context.
IndicatorMaliciousRatioCalculation	Return indicators appears in resolved incidents, and resolved incident ids. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ExportIndicatorsToCSV	This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.
MaliciousRatioReputation	Set indicator reputation to "suspicious" when malicious ratio is above threshold. Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.
LookupCSV	Parses a CSV and looks for a specific value in a specific column, returning a dict of the entire matching row. If no column value is specified, the entire CSV is read into the context.
StringReplace	Replaces regex match/es in string. Returns the string after replace was preformed.
GetIndicatorDBotScoreFromCache	Get the overall score for the indicator as calculated by DBot.
ShowOnMap	Returns a map entry with a marker on the given coordinates (lat,lng), or address (requires a configured GoogleMaps instance).
BMCTool	Parse RDP bitmap cache data into a single collage image file.
ConvertFile	Converts a file from one format to a different format by using the convert-to function of Libre Office. For a list of supported input/output formats see: https://wiki.openoffice.org/wiki/Framework/Article/Filter/FilterList_OOo_3_0
RepopulateFiles	After running DeleteContext, this script can repopulate all the file entries in the ${File} context key
GetByIncidentId	Gets a value from the specified incident's context.
GetByAlertId	Gets a value from the specified alert's context.
TimeStampCompare	Compares a single timestamp to a list of timestamps.
CheckContextValue	This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values.
ReadFile	Load the contents of a file into context.
IsMaliciousIndicatorFound	Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.
FileReputation	A context script for hash entities.
ConvertTableToHTML	Converts a given array to an HTML table
DockerHardeningCheck	Checks if the Docker container running this script has been hardened according to the recommended settings at: For Docker hardening guide (Cortex XSOAR 6.13) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide For Docker hardening guide (Cortex XSOAR 8 Cloud) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Docker-hardening-guide For Docker hardening guide (Cortex XSOAR 8.7 On-prem) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Docker-hardening-guide.
ContainsCreditCardInfo	Check if a given value is true. Will return 'no' otherwise
ServerLogs	Uses the ssh integration to grab the host server logs.
BinarySearchPy	Deprecated. No available replacement. Search for a binary on an endpoint using Carbon Black
GetDuplicatesMlv2	Deprecated. Use the "PhishingDedupPreprocessingRule" script instead. Find duplicate incidents candidates. Using machine learning techniques with pre-defined data (can also use data from the local environment), this script takes into consideration different features such as: labels comparison, email labels (relevant for phishing), incident time difference and shared indicators, which can be customized by the arguments. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CheckSenderDomainDistance	Get the string distance for the sender from our domain
cveReputationV2	Provides the severity of the CVE based on the CVSS score where available.
listExecutedCommands	Lists executed commands in War Room
IsIPInRanges	Returns yes if the IP is in one of the ranges provided, returns no otherwise.
ExtractDomainAndFQDNFromUrlAndEmail	Extracts domains and FQDNs from URLs and emails.
PopulateCriticalAssets	Populates critical assets in a grid field that has the section headers "Asset Type" and "Asset Name".
GetTime	Retrieves the current date and time.
checkValue	Gets a value and return it. This is to be used in playbook conditional tasks - get a value from incident field, label or context, and act accordingly. If an array is returned. the first value will be the decision making value.
ShowScheduledEntries	Show all scheduled entries for specific incident.
FormatURL	Strips, unquotes and unescapes URLs. If the URL is a Proofpoint or ATP URL, extracts its redirect URL. If more than one URL is passed to the formatter, the separator must be a pipe ("\|").
SCPPullFiles	Take a list of devices and pull a specific file (given by path) from each using SCP.
IncidentFields	Returns a dict of all incident fields that exist in the system.
AlertFields	Returns a dict of all alert fields that exist in the system.
PrintToParentIncident	Prints a value to the parent incident's war-room of the current alert.
StopScheduledTask	This stops the scheduled task whose ID is given in the taskID argument.
GenerateRandomString	Generates random string
ChangeContext	Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values.
Dig	DNS lookup utility to provide 'A' and 'PTR' record.
URLReputation	A context script for URL entities.
ConvertCountryCodeCountryName	Convert country name to country code or country code to country name. Only one of 'country_code' or 'country_name' can be provided. Example: Input: { "country_code": "US" } Output: { "United States" } Another Example: Input: { "country_name": "United States" } Output: { "US" }.
GenerateAsBuilt	Generate an as built document, as HTML, based on the running XSOAR instance. Requires an instance of the Demisto API integration configured.
emailFieldTriggered	Sends email to incident owner when selected field is triggered.
DBotAverageScore	The script calculates the average DBot score for each indicator in the context.
IsIntegrationAvailable	Returns 'yes' if integration brand is available. Otherwise returns 'no'.
CreateArray	Will create an array object in context from given string input
ParseEmailFiles	Deprecated. Use ParseEmailFilesV2 instead." Parse an email from an eml or msg file and populate all relevant context data to investigate the email. Also extracts inner attachments and returns them to the war room. The incident labels themselves are preserved and not modified - only the "Label/x" context items that originated from the labels, and the best practice is to rely on these for the remainder of the playbook.
ResolveShortenedURL	This script resolves the original URL from a given shortened URL and places the resolved URL in the playbook context and output.
CopyNotesToIncident	Copy all entries marked as notes from current incident to another incident.
CopyNotesToAlert	Copy all entries marked as notes from current alert to another alert.
Print	Prints text to war room (Markdown supported)
ParseCSV	This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context.
SetGridField	Creates a Grid table from items or key-value pairs.
hideFieldsOnNewIncident	When you apply this script to an incident field, that incident field is hidden for new incidents, and it displays in edit mode.
hideFieldsOnNewAlert	When you apply this script to an alert field, that alert field is hidden for new alerts, and it displays in edit mode.
RemoveKeyFromList	Removes a key in key/value store backed by an XSOAR list.
PrintContext	Pretty-print the contents of the playbook context.
IsolationAssetWrapper	This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex).
UnPackFile	Deprecated. Use the UnzipFile script instead. UnPack a file using fileName or entryID to specify a file. Files unpacked will be pushed to the war room and names will be pushed to the context. supported types are: 7z (.7z), ACE (.ace), ALZIP (.alz), AR (.a), ARC (.arc), ARJ (.arj), BZIP2 (.bz2), CAB (.cab), compress (.Z), CPIO (.cpio), DEB (.deb), DMS (.dms), GZIP (.gz), LRZIP (.lrz), LZH (.lha, .lzh), LZIP (.lz), LZMA (.lzma), LZOP (.lzo), RPM (.rpm), RAR (.rar), RZIP (.rz), TAR (.tar), XZ (.xz), ZIP (.zip, .jar) and ZOO (.zoo)
NotInContextVerification	Not in context verification is a script that executes the given command and verifies that the specified field is not in the context after execution.
Base64EncodeV2	Encodes an input to Base64 format.
IsValueInArray	Indicates whether a given value is a member of given array
IsEmailAddressInternal	Checks if the email address is part of the internal domains.
SSDeepSimilarity	This script finds similar files that can be related to each other by fuzzy hash (SSDeep).
DisplayHTMLWithImages	Display HTML with embedded images.
IncreaseIncidentSeverity	Optionally increases the incident severity to the new value if it is greater than the existing severity.
IncreaseAlertSeverity	Optionally increases the alert severity to the new value if it is greater than the existing severity.
ContextGetEmails	Gets all email addresses in context, excluding ones given.
AquatoneDiscoverV2	aquatone-discover will find the targets nameservers and shuffle DNS lookups between them. Should a lookup fail on the target domains nameservers, aquatone-discover will fall back to using Google public DNS servers to maximize discovery.
CVSSCalculator	This script calculates the CVSS Base Score, Temporal Score, and Environmental Score using either the CVSS 3.0 or CVSS 3.1 calculator according to https://www.first.org/cvss/ calculation documentation.
AddKeyToList	Adds/Replaces a key in key/value store backed by an XSOAR list.
RunDockerCommand	This command will allow you to run commands against a local Docker Container. You can run commands like wc for instance with word count, or other types of commands that you want on the docker container. We recommend for tools that you want to use that are not part of the default Docker container, to cope this Automation script and then create a customer docker container with /docker_image_create with a custom docker container to add any command level tool to Demisto and output the results directly to the context.
DisableUserWrapper	This script allows disabling a specified user using one or more of the following integrations: SailPointIdentityIQ, ActiveDirectoryQuery, Okta, MicrosoftGraphUser, and IAM.
CreateNewIndicatorsOnly	Create indicators to the Threat Intel database only if they are not registered. All submitted indicators will be associated with the parent incident. When using the script with many indicators, or when the Threat Intel Management database is highly populated, this script may have low performance issue.
ProvidesCommand	Finds which integrations implement a specific Demisto command. The results will be returned as comma-separated values (CSV). The "Core REST API" integration must first be enabled.
isError	Check whether given entry/entries returned an error. Use ${lastCompletedTaskEntries} to check the previous task entries. If array is provided, will return yes if one of the entries returned an error.
ListUsedDockerImages	List all Docker images that are in use by the installed integrations and automations.
PrintRaw	Prints a raw representation of a string or object, visualising things likes tabs and newlines. For instance, '\n' will be displayed instead of a newline character, or a Windows CR will be displayed as '\r\n'. This is useful for debugging issues where things aren't behaving as expected, such as when parsing a string with a regular expression.
IsPDFFileEncrypted	Checks whether the PDF file is encrypted.
FileToBase64List	Encode a file as base64 and store it in a Demisto list.
DumpJSON	Dumps a json from context key input, and returns a json object string result
ExtractIndicatorsFromTextFile	Extract indicators from a text-based file. Indicators that can be extracted: IP Domain URL File Hash Email Address This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
SSDeepReputation	Calculate ssdeep reputation based on similar files (by ssdeep similarity) on the system.
IsUrlPartOfDomain	Checks if the supplied URLs are in the specified domains.
CompareLists	Compare two lists and put the differences in context.
SetIndicatorGridField	This script updates an indicator's grid field in Cortex with provided row data. You can input the rows directly or extract them from the context.
JSONFileToCSV	Script to convert a War Room output JSON File to a CSV file.
MITRENameByID_Formatter	Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).
ExtractIndicatorsFromWordFile	Used to extract indicators from Word files (DOC, DOCX). The script does not extract data from macros (e.g., embedded code). This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
ExtractAttackPattern	Extract Attack Pattern Threat Intel Object. After auto extract extracts the Attack Pattern IDs, this script is executed and extracts the value (name) of the Attack Pattern.
CertificateExtract	Extract fields from a certificate file and return the standard context.
ExportToCSV	Export given array to csv file.
PositiveDetectionsVSDetectionEngines	Shows a bar chart of the number of Positive Detections out of overall detections
DownloadAndArchivePythonLibrary	The script downloads a Python library using PIP, archives it, and returns the file to the war room.
ConvertTimezoneFromUTC	Takes UTC and converts it to the specified timezone. Format must match the UTC date's format and output will be the same format. Can use in conjunction with ConvertDateToString
PrintErrorEntry	Prints an error entry with a given message.
IPToHost	Try to get the hostname correlated with the input IP.
StringSimilarity	This automation calculates the similarity ratio between every string in 2 different arrays and outputs a decimal value between 0.0 and 1.0 (1.0 if the sequences are identical, and 0.0 if they don't have anything in common).
DecodeMimeHeader	Decode MIME base64 headers.
GetListRow	Parses a list by header and value.
ExtractEmailV2	Verifies that an email address is valid and only returns the address if it is valid.
GenericPollingScheduledTask	Runs the polling command repeatedly, completes a blocking manual task when polling is done.
ConvertDatetoUTC	Converts a date from a different timezone to UTC timezone.
ParseYAML	Parses a YAML string into context.
VerifyJSON	Verifies if the supplied JSON string is valid and optionally verifies against a provided schema. The script utilizes Powershell's Test-JSON cmdlet.
PublishEntriesToContext	Publish entries to incident's context
HTMLtoMD	Converts HTML to Markdown.
displayMappedFields	Display the mapped fields in a dynamic-section.
PrintToIncident	Prints a value to the specified incident's war-room.
FeedRelatedIndicatorsWidget	Widget script to view information about the relationship between an indicator, entity and other indicators and connect to indicators, if relevant.
CreateIndicatorsFromSTIX	Creates indicators from the submitted STIX file. Supports STIX 1.0 and STIX 2.x. This automation creates indicators and adds an indicator's relationships if available.
CEFParser	Parse CEF data into the context. Please notice that outputs will display only the 7 mandatory fields even if the CEF event includes many other custom or extended fields.
TextFromHTML	Extract regular text from the given HTML.
ContextContains	This script searches for a value in a context path.
ExtractHTMLTables	Find tables inside HTML and extract the contents into objects using the following logic: If table has a single column, just create an array of strings from the values If table has 2 columns and has no header row, treat the first column as key and second as value and create a table of key/value If table has a header row, create a table of objects where attribute names are the headers If table does not have a header row, create table of objects where attribute names are cell1, cell2, cell3…
GetDomainDNSDetails	Returns DNS details for a domain.
UnEscapeIPs	Remove escaping chars from IP 127[.]0[.]0[.]1 -> 127.0.0.1
IsTrue	Check if a given value is true. Will return 'no' otherwise
enrich_exclude_button	This script is only meant to be used to disable the Enrich Excluded button in an indicator. It should not be used otherwise.
ReplaceMatchGroup	Returns a string with all matches of a regex pattern groups replaced by a replacement.
CertificateReputation	Enrich and calculate the reputation of a certificate indicator.
CheckFieldValue	This script checks that a field exists (and contains data), and optionally checks the value of the field for a match against an input value. If a regex is not supplied, the script checks that the field is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value.
ParseExcel	The automation takes Excel file (entryID) as an input and parses its content to the war room and context.
GetInstances	Returns integration instances configured in Cortex. You can filter by instance status and/or brand name (vendor).
GetFieldsByIncidentType	Returns the incident field names associated to the specified incident type.
GetFieldsByAlertType	Returns the alert field names associated to the specified alert type.
WordTokenizer	Deprecated. Use DBotPreProcessTextData instead.
GetStringsDistance	Get the string distance between inputString and compareString (compareString can be a comma-separated list) based on Levenshtein Distance algorithm.
GetDataCollectionLink	Generates the URL for a Data Collection Task into Context. Can be used to get the url for tasks send via Email, Slack, or even if you select "By Task Only". To generate links for specific users, add an array of users in the users argument.
ExposeIncidentOwner	Expose the incident owner into IncidentOwner context key
ExposeAlertOwner	Expose the alert owner into AlertOwner context key
PDFUnlocker	Removing the password protection from a PDF file and adding a new file entry with the unlocked PDF.
Base64Encode	Will encode an input using Base64 format.
GetIndicatorDBotScore	Add into the incident's context the system internal DBot score for the input indicator.
GenerateRandomUUID	Generates a random UUID (UUID 4).
URLNumberOfAds	Fetches the numbers of ads in the given url.
StringLength	Returns the length of the string passed as argument
ticksToTime	Converting time in Ticks to readable time. Ticks are used to represent time by some vendors, most commonly by Microsoft.
UnEscapeURLs	Extract URLs redirected by security tools like Proofpoint. Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com
OnionURLReputation	This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.
Strings	Extract strings from a file with optional filter - similar to binutils strings command

Incident Fields

Name	Description
State where the breach took place
Company Address
Sector of Affected Party
Approximate number of affected data subjects
Country where business has its main establishment	"‘main establishment’ means: as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;" - GDPR Art. 4
Is the Data Subject to DPIA
Management Notification
PII Data Type
Resident Notification Option
Company City
Residents Email Address
Data Encryption Status
Postal Code
Other PII data breached	Is other PII data breached
Telephone no.
Malicious Cause (If the cause is a malicious attack)
State CISO Notification
Company Name
E-mail Address
Attorney General Notification
GDPR Notify Authorities	"In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." - GDPR Art. 33
Company has Insurance for the Breach
Secretary Notification
Company Postal Code
Account information breached	Is account information breached
Contact Email address
Size - number of employees
Consumer Reporting Agencies Notification
Media Notification	The status of the media notification
Where is data hosted
Affected data	"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;" - GDPR Art. 4
DPO Notification
Unique identification number breached	Is unique identification number breached
Likely Impact	"A data protection impact assessment (…) shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale. - GDPR Art. 35
Size - turnover
Individuals Notification
Contact Name
Financial information breached	Is financial information breached
Affected Data Type
Medical Information breached	Is Medical Information breached
Contact Address
Breach Confirmation	Is the DPO confirm the breach
Health insurance breached	Is health insurance breached
DPO E-mail Address
Affected Individuals Contact Information
Unique biometric data breached	Is unique biometric data breached
Contact Telephone number
Possible Cause of the Breach
Measures to Mitigate	" (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects." - GDPR Art. 33

Lists

Name	Description
PrivateIPs

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

Optional Content Packs (15)

Pack Name	Pack By
US - Breach Notification	By: Cortex XSOAR
Brute Force	By: Cortex XSOAR
Elasticsearch	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
GDPR	By: Cortex XSOAR
Gmail	By: Cortex XSOAR
Gmail Single User	By: Cortex XSOAR
HIPAA - Breach Notification	By: Cortex XSOAR
IBM Security QRadar SOAR	By: Cortex XSOAR
Mail Sender (New)	By: Cortex XSOAR
Microsoft Graph Mail	By: Cortex XSOAR
ProtectWise	By: Cortex XSOAR
Remote Access	By: Cortex XSOAR
Shodan	By: Cortex XSOAR
Sumo Logic	By: Cortex XSOAR

All level dependencies (2)

Pack Name	Pack By
Cortex REST API	By: Cortex XSOAR
Base	By: Cortex XSOAR

1.19.45 - 3161494 (April 17, 2025)

Scripts

URLSSLVerification

Updated the SSL certificate verification for all redirect chain.
- If the initial URL is HTTP and redirects to HTTPS with a valid certificate, verified = True.
- If the entire redirect chain remains HTTP, verified = False.
set_http_as_suspicious updated logics.
- if set_http_as_suspicious='true' and the URL is http then DbotScore = Suspicious.
- if set_http_as_suspicious='true' and the URL is https DbotScore = Unknown.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39533

Download

1.19.44 - 3133732 (April 14, 2025)

Scripts

ExportIncidentsToCSV

Fixed an issue where the script failed when no results were returned or when the number of results exceeded the defined limit.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

clear-user-session

Changed the clear-user-session command context.
- The structure of the context output has been modified. from {'Message': str, 'Result': str, 'Source': list[str], 'Username': str} to {'Message': str, 'Result': str, 'Brand': str, 'Username': str}.
- Each user and brand will now have their own dictionary instead of one dictionary for each user with a list of sources/brands.
Updated handling the get-user-data command context change.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39397

Download

1.19.42 - 3079234 (April 7, 2025)

Scripts

New: JSONDiff

New: Added a new script- JSONDiff that compares two JSON files and returns their differences, such as added, removed, or changed fields, in a structured format.

ExportAuditLogsToFile

Fixed an issue that caused only 100 records to be retrieved.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

ContentPackInstaller

Updated the Docker image to: demisto/xsoar-tools:1.0.0.2974997.

ProvidesCommand

Updated the Docker image to: demisto/python3:3.12.8.1983910.

GenerateAsBuilt

Updated the Docker image to: demisto/teams:1.0.0.2027266.

GetFieldsByIncidentType

Updated the Docker image to: demisto/python3:3.12.8.1983910.

IncidentFields

Updated the Docker image to: demisto/python3:3.12.8.1983910.

EditServerConfig

Updated the Docker image to: demisto/python3:3.12.8.1983910.

ExportIndicatorsToCSV

Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39489
- 37711
- 39497
- 38761

Download

1.19.39 - 3062885 (April 6, 2025)

Scripts

FormatURL

Updated the FormatURL script to handle numerical IPs in URLs.

Related pull requests:
- 39033

Download

1.19.38 - 3042633 (April 2, 2025)

Scripts

MaliciousRatioReputation

- Documentation and metadata improvements.

VerifyIPv6Indicator

- Documentation and metadata improvements.

cveReputationV2

- Documentation and metadata improvements.

GetEnabledInstances

- Documentation and metadata improvements.

HTTPListRedirects

- Documentation and metadata improvements.

CheckFieldValue

- Documentation and metadata improvements.

JSONtoCSV

- Documentation and metadata improvements.

CloseInvestigationAsDuplicate

- Documentation and metadata improvements.

displayMappedFields

- Documentation and metadata improvements.

DecodeMimeHeader

- Documentation and metadata improvements.

IPToHost

- Documentation and metadata improvements.

PrintRaw

- Documentation and metadata improvements.

AppendindicatorFieldWrapper

- Documentation and metadata improvements.

ZipStrings

- Documentation and metadata improvements.

SetGridField

- Documentation and metadata improvements.

ConvertDatetoUTC

- Documentation and metadata improvements.

ZipFile

- Documentation and metadata improvements.

ChangeRemediationSLAOnSevChange

- Documentation and metadata improvements.

GetLicenseID

- Documentation and metadata improvements.

cvss_color

- Documentation and metadata improvements.

GeneratePassword

- Documentation and metadata improvements.

FormatURL

- Documentation and metadata improvements.

SendEmailOnSLABreach

- Documentation and metadata improvements.

GenerateSummaryReportButton

- Documentation and metadata improvements.

SetTime

- Documentation and metadata improvements.

GetEntries

- Documentation and metadata improvements.

EncodeToAscii

- Documentation and metadata improvements.

VerifyCIDR

- Documentation and metadata improvements.

ExtractIndicatorsFromWordFile

- Documentation and metadata improvements.

ExportAuditLogsToFile

- Documentation and metadata improvements.

CertificateExtract

- Documentation and metadata improvements.

enrich_exclude_button

- Documentation and metadata improvements.

IncidentFields

- Documentation and metadata improvements.

IPNetwork

- Documentation and metadata improvements.

ExtractDomainAndFQDNFromUrlAndEmail

- Documentation and metadata improvements.

SearchIncidentsSummary

- Documentation and metadata improvements.

displayUtilitiesResults

- Documentation and metadata improvements.

ExifRead

- Documentation and metadata improvements.

ContentPackInstaller

- Documentation and metadata improvements.

ContextContains

- Documentation and metadata improvements.

GetStringsDistance

- Documentation and metadata improvements.

GetFieldsByIncidentType

- Documentation and metadata improvements.

ServerLogs_docker

- Documentation and metadata improvements.

GetIndicatorDBotScoreFromCache

- Documentation and metadata improvements.

DBotAverageScore

- Documentation and metadata improvements.

UtilAnyResults

- Documentation and metadata improvements.

NumberOfPhishingAttemptPerUser

- Documentation and metadata improvements.

PreProcessImage

- Documentation and metadata improvements.

FeedRelatedIndicatorsWidget

- Documentation and metadata improvements.

LoadJSONFileToContext

- Documentation and metadata improvements.

ExtractIndicatorsFromTextFile

- Documentation and metadata improvements.

GetDataCollectionLink

- Documentation and metadata improvements.

Ping

- Documentation and metadata improvements.

ResolveShortenedURL

- Documentation and metadata improvements.

StringSimilarity

- Documentation and metadata improvements.

ReadFile

- Documentation and metadata improvements.

Base64EncodeV2

- Documentation and metadata improvements.

DockerHardeningCheck

- Documentation and metadata improvements.

get-endpoint-data

- Documentation and metadata improvements.

SetDateField

- Documentation and metadata improvements.

ReadPDFFileV2

- Documentation and metadata improvements.

FileReputation

- Documentation and metadata improvements.

PrintErrorEntry

- Documentation and metadata improvements.

RunPollingCommand

- Documentation and metadata improvements.

GetErrorsFromEntry

- Documentation and metadata improvements.

SearchIncidentsV2

- Documentation and metadata improvements.

ShowIncidentIndicators

- Documentation and metadata improvements.

HTMLtoMD

- Documentation and metadata improvements.

GetDomainDNSDetails

- Documentation and metadata improvements.

IPReputation

- Documentation and metadata improvements.

Strings

- Documentation and metadata improvements.

ParseWordDoc

- Documentation and metadata improvements.

ProvidesCommand

- Documentation and metadata improvements.

ReplaceMatchGroup

- Documentation and metadata improvements.

GetIndicatorDBotScore

- Documentation and metadata improvements.

ParseYAML

- Documentation and metadata improvements.

OnionURLReputation

- Documentation and metadata improvements.

ParseExcel

- Documentation and metadata improvements.

SSDeepReputation

- Documentation and metadata improvements.

DisplayHTMLWithImages

- Documentation and metadata improvements.

DomainReputation

- Documentation and metadata improvements.

LoadJSON

- Documentation and metadata improvements.

IsDomainInternal

- Documentation and metadata improvements.

SetByIncidentId

- Documentation and metadata improvements.

CalculateEntropy

- Documentation and metadata improvements.

SCPPullFiles

- Documentation and metadata improvements.

AddKeyToList

- Documentation and metadata improvements.

get-user-data

- Documentation and metadata improvements.

ConvertXmlFileToJson

- Documentation and metadata improvements.

StopTimeToAssignOnOwnerChange

- Documentation and metadata improvements.

PDFUnlocker

- Documentation and metadata improvements.

BreachConfirmationHTML

- Documentation and metadata improvements.

ExtractDomainFromUrlAndEmail

- Documentation and metadata improvements.

IsIPPrivate

- Documentation and metadata improvements.

IndicatorMaliciousRatioCalculation

- Documentation and metadata improvements.

EditServerConfig

- Documentation and metadata improvements.

URLSSLVerification

- Documentation and metadata improvements.

MITRENameByID_Formatter

- Documentation and metadata improvements.

GenerateRandomString

- Documentation and metadata improvements.

SetMultipleValues

- Documentation and metadata improvements.

CompareLists

- Documentation and metadata improvements.

StixCreator

- Documentation and metadata improvements.

PopulateCriticalAssets

- Documentation and metadata improvements.

TimeStampCompare

- Documentation and metadata improvements.

ExtractAttackPattern

- Documentation and metadata improvements.

ConvertFile

- Documentation and metadata improvements.

SetWithTemplate

- Documentation and metadata improvements.

JSONFileToCSV

- Documentation and metadata improvements.

CommandLineAnalysis

- Documentation and metadata improvements.

ExtractHTMLTables

- Documentation and metadata improvements.

CertificateReputation

- Documentation and metadata improvements.

FileCreateAndUploadV2

- Documentation and metadata improvements.

AssignToMeButton

- Documentation and metadata improvements.

Dig

- Documentation and metadata improvements.

PcapHTTPExtractor

- Documentation and metadata improvements.

JsonUnescape

- Documentation and metadata improvements.

URLReputation

- Documentation and metadata improvements.

VerdictResult

- Documentation and metadata improvements.

ShowLocationOnMap

- Documentation and metadata improvements.

LookupCSV

- Documentation and metadata improvements.

DisplayHTML

- Documentation and metadata improvements.

CheckSenderDomainDistance

- Documentation and metadata improvements.

RunDockerCommand

- Documentation and metadata improvements.

SetIndicatorGridField

- Documentation and metadata improvements.

LanguageDetect

- Documentation and metadata improvements.

EmailReputation

- Documentation and metadata improvements.

clear-user-session

- Documentation and metadata improvements.

AquatoneDiscoverV2

- Documentation and metadata improvements.

ExportIncidentsToCSV

- Documentation and metadata improvements.

IsInternalDomainName

- Documentation and metadata improvements.

URLNumberOfAds

- Documentation and metadata improvements.

FilterByList

- Documentation and metadata improvements.

IsListExist

- Documentation and metadata improvements.

DisableUserWrapper

- Documentation and metadata improvements.

GetByIncidentId

- Documentation and metadata improvements.

StopScheduledTask

- Documentation and metadata improvements.

GenerateRandomUUID

- Documentation and metadata improvements.

BMCTool

- Documentation and metadata improvements.

UnzipFile

- Documentation and metadata improvements.
Fix an issue where the UnzipFile script incorrectly failed when extracting a file containing the word "Errors" in its name.
Updated the Docker image to: demisto/unzip:1.0.0.2038416.

SSDeepSimilarity

- Documentation and metadata improvements.

AddDBotScoreToContext

- Documentation and metadata improvements.

MarkAsEvidenceByTag

- Documentation and metadata improvements.

DumpJSON

- Documentation and metadata improvements.

IsUrlPartOfDomain

- Documentation and metadata improvements.

IsPDFFileEncrypted

- Documentation and metadata improvements.

GetServerURL

- Documentation and metadata improvements.

ConvertCountryCodeCountryName

- Documentation and metadata improvements.

PrettyPrint

- Documentation and metadata improvements.

CopyNotesToIncident

- Documentation and metadata improvements.

DownloadAndArchivePythonLibrary

- Documentation and metadata improvements.

CheckIndicatorValue

- Documentation and metadata improvements.

TextFromHTML

- Documentation and metadata improvements.

CreateIndicatorsFromSTIX

- Documentation and metadata improvements.

ExportContextToJSONFile

- Documentation and metadata improvements.

MatchRegexV2

- Documentation and metadata improvements.

TopMaliciousRatioIndicators

- Documentation and metadata improvements.

LinkIncidentsButton

- Documentation and metadata improvements.

CompareIncidentsLabels

- Documentation and metadata improvements.

CreateHash

- Documentation and metadata improvements.

IsInternalHostName

- Documentation and metadata improvements.

ReadQRCode

- Documentation and metadata improvements.

ParseCSV

- Documentation and metadata improvements.

ExtractHyperlinksFromOfficeFiles

- Documentation and metadata improvements.

ExportIndicatorsToCSV

- Documentation and metadata improvements.

ConvertTimezoneFromUTC

- Documentation and metadata improvements.

IsolationAssetWrapper

- Documentation and metadata improvements.

FileToBase64List

- Documentation and metadata improvements.

hideFieldsOnNewIncident

- Documentation and metadata improvements.

GenerateAsBuilt

- Documentation and metadata improvements.

RepopulateFiles

- Documentation and metadata improvements.

Base64ListToFile

- Documentation and metadata improvements.

GenerateAsBuiltConfiguration

- Documentation and metadata improvements.

ListUsedDockerImages

- Documentation and metadata improvements.

GetListRow

- Documentation and metadata improvements.

ParseEmailFilesV2

- Documentation and metadata improvements.

ParseHTMLIndicators

- Documentation and metadata improvements.

ServerLogs

- Documentation and metadata improvements.

DeduplicateValuesbyKey

- Documentation and metadata improvements.

CopyContextToField

- Documentation and metadata improvements.

SearchIndicator

- Documentation and metadata improvements.

GetInstances

- Documentation and metadata improvements.

RemoveKeyFromList

- Documentation and metadata improvements.

ScheduleGenericPolling

- Documentation and metadata improvements.

IdentifyAttachedEmail

- Documentation and metadata improvements.

HttpV2

- Documentation and metadata improvements.

FetchIndicatorsFromFile

- Documentation and metadata improvements.

ExtractFQDNFromUrlAndEmail

- Documentation and metadata improvements.

CheckContextValue

- Documentation and metadata improvements.

PrintContext

- Documentation and metadata improvements.

PositiveDetectionsVSDetectionEngines

- Documentation and metadata improvements.

CreateNewIndicatorsOnly

- Documentation and metadata improvements.

GetDockerImageLatestTag

- Documentation and metadata improvements.

MarkAsNoteByTag

- Documentation and metadata improvements.

CalculateTimeDifference

- Documentation and metadata improvements.

CVSSCalculator

- Documentation and metadata improvements.

ExtractEmailV2

- Documentation and metadata improvements.

ArrayToCSV

- Documentation and metadata improvements.

ChangeContext

- Documentation and metadata improvements.

ExportToXLSX

- Documentation and metadata improvements.

GridFieldSetup

- Documentation and metadata improvements.

AnalyzeTimestampIntervals

- Documentation and metadata improvements.

PortListenCheck

- Documentation and metadata improvements.

Related pull requests:
- 39390

Download

1.19.36 - 3014055 (March 30, 2025)

Scripts

GetTime

Documentation and metadata improvements.

Related pull requests:
- 39311

Download

1.19.35 - R2992747 (March 27, 2025)

Scripts

FormatURL

Fixed an issue where a URL encoded as ProofPoint URLDefense v3 was not properly extracted.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39086

Download

1.19.34 - 2929110 (March 20, 2025)

Scripts

DBotUpdateLogoURLPhishing

Breaking changes: Make sure to update the Phishing URL pack, before this pack, to avoid losing the DBotUpdateLogoURLPhishing script.
Note: Moved the DBotUpdateLogoURLPhishing script to the Phishing URL pack.

Related pull requests:
- 39007

Download

1.19.33 - 2914826 (March 19, 2025)

Scripts

IsPDFFileEncrypted

Improved documentation.

Related pull requests:
- 39052

Download

1.19.32 - 2895868 (March 17, 2025)

Scripts

IPNetwork

Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39066
- 38344
- 39003
- 38344

Download

1.19.31 - 2691641 (March 9, 2025)

Scripts

FormatURL

Updated the FormatURL script to allow URLs with numerical IPs.

Related pull requests:
- 38923

Download

1.19.30 - 2620282 (March 3, 2025)

Scripts

Set

Fixed an issue where integers were set to the context as strings.
Values greater than 9007199254740991 will still be set as strings.

Related pull requests:
- 38818

Download

1.19.29 - 2613464 (March 2, 2025)

Scripts

DeleteContext

Internal code improvements.

Related pull requests:
- 38651

Download

1.19.28 - 2480529 (February 17, 2025)

Scripts

New: IsPDFFileEncrypted

New: Added a new script IsPDFFileEncrypted that checks whether the PDF file is encrypted.

Related pull requests:
- 38649

Download

1.19.27 - 2472843 (February 16, 2025)

Scripts

emailFieldTriggered

Fixed an issue where emails were not being sent due to incorrect owner matching.

Related pull requests:
- 38615

Download

1.19.26 - 2459630 (February 13, 2025)

Scripts

MITRENameByID_Formatter

Improved implementation by restricting the query to certain indicator types.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 38596
- 38630

Download

1.19.25 - 2438447 (February 11, 2025)

Scripts

ParseEmailFilesV2

Fixed an issue where the ParseEmailFilesV2 script failed parsing a file contains BOM.

StixCreator

Fixed an issue where under specific conditions the exported times of the indicators were presented as UTC when they were actually in local time. All the exported times are now correctly parsed into UTC the time zone.

Related pull requests:
- 38349

Download

1.19.23 - 2395597 (February 10, 2025)

Scripts

VerifyJSON

Updated the Docker image to: demisto/powershell:7.4.6.117357.

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.2017685.

Related pull requests:
- 38552
- 38543
- 38544
- 38546
- 38547

Download

1.19.22 - 2306914 (February 9, 2025)

Scripts

CloseInvestigationAsDuplicate

Added support for raise_error argument, which allows raising an error in case of unclosed incident.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

CreateNewIndicatorsOnly

Fixed an issue where the value of an existing indicator had a different letter case than the indicator on input.
Fixed an issue where the script tried to associate to the incident an indicator that was not created, as it might have been excluded.
Updated the Docker image to: demisto/python3:3.11.11.1940698.

Related pull requests:
- 38535
- 38429

Download

1.19.20 - 2151668 (February 6, 2025)

Scripts

ParseEmailFilesV2

Fixed an issue where some EML files were incorrectly decoded.
Updated the Docker image to: demisto/parse-emails:1.0.0.2147169.

Related pull requests:
- 38511

Download

1.19.19 - 2148169 (February 5, 2025)

Scripts

EmailAskUserResponse

Fixed an issue where the script failed to run for any value.

Related pull requests:
- 38509

Download

1.19.18 - 2134850 (February 4, 2025)

Scripts

ParseEmailFilesV2

Fixed an issue that prevented the headers from being parsed correctly for eml files (unknown-8bit encoding).
Fixed an issue that email with attachment was parsed incorrectly for eml files.
Updated the Docker image to: demisto/parse-emails:1.0.0.2128577.

Related pull requests:
- 38462

Download

1.19.17 - 2110804 (January 30, 2025)

Scripts

CommandLineAnalysis

Fixed an issue in CommandLineAnalysis where the original command was analyzed as part of the decoded command analysis.
Updated the output format of the extracted indicators.
Added the patterns to detect macOS Applescript suspicious command lines.

Related pull requests:
- 38325

Download

1.19.16 - 2094777 (January 28, 2025)

Scripts

ParseEmailFilesV2

Documentation and metadata improvements. Updated the parse_only_headers argument description for clarity.

Related pull requests:
- 38255

Download

1.19.15 - 2090051 (January 28, 2025)

Scripts

EmailAskUserResponse

Added a new argument suffix to be used to remove a known suffix in the response.

Related pull requests:
- 38351

Download

1.19.14 - 2081957 (January 27, 2025)

Scripts

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.2034953.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.2034953.

Related pull requests:
- 38318
- 38316

Download

1.19.12 - 2074399 (January 26, 2025)

Scripts

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.2034848.

Related pull requests:
- 38288
- 38283
- 38281
- 38280
- 38279
- 38278
- 38276
- 38275
- 38274
- 38272
- 38271
- 38273
- 38277
- 38282

Download

1.19.11 - R2065467 (January 23, 2025)

Scripts

EmailAskUserResponse

Added a new argument prefix to be used to remove a known prefix in the response.

Related pull requests:
- 38218

Download

1.19.10 - R1989294 (January 14, 2025)

Scripts

GetDomainDNSDetails

Updated the Docker image to: demisto/netutils:1.0.0.118055.

Ping

Updated the Docker image to: demisto/netutils:1.0.0.118055.

HttpV2

Fixed an issue where the timeout_between_retries argument was treated as a string instead of being converted to a number.

Related pull requests:
- 38109

Download

1.19.8 - 1953876 (January 9, 2025)

Scripts

LookupCSV

Updated the Docker image to: demisto/python3:3.11.11.1940698.

CreateHash

Updated the Docker image to: demisto/python3:3.11.11.1940698.

BMCTool

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

CertificateReputation

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

clear-user-session

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

GenerateAsBuiltConfiguration

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

GetDockerImageLatestTag

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

ResolveShortenedURL

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

UnzipFile

Code functionality improvements.
Updated the Docker image to: demisto/unzip:1.0.0.117525.

Related pull requests:
- 38043

Download

1.19.6 - 1950870 (January 8, 2025)

Scripts

ExtractDomainAndFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.117220.

IPToHost

Updated the script to display a clear message when no hostname is found, instead of returning the IP address.
Updated the Docker image to: demisto/python3:3.11.11.1940698.

Related pull requests:
- 38045

Download

1.19.4 - 1946497 (January 8, 2025)

Scripts

SetGridField

Documentation and metadata improvements.

Related pull requests:
- 37991

Download

1.19.3 - 1935630 (January 6, 2025)

Scripts

AddKeyToList

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

CVSSCalculator

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

Dig

Code functionality and documentation improvements.
Updated the Docker image to: demisto/netutils:1.0.0.118055.

ExtractHTMLTables

Code functionality and documentation improvements.

IndicatorMaliciousRatioCalculation

Code functionality and documentation improvements.

ParseYAML

Code functionality and documentation improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

RemoveKeyFromList

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

SSDeepReputation

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

Related pull requests:
- 37472

Download

1.19.2 - 1928124 (January 5, 2025)

Scripts

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.117511.

Related pull requests:
- 37789
- 37773
- 37772
- 37774
- 37771

Download

1.19.1 - 1915967 (January 2, 2025)

Scripts

get-user-data

Added the attributes parameter to the ad-get-user command in this script to retrieve additional user information.

Related pull requests:
- 37908

Download

1.19.0 - 1873754 (December 25, 2024)

Scripts

New: get-endpoint-data

New: This script gathers endpoint data from multiple integrations and returns an endpoint entity with consolidated information to the context. (Available from Cortex XSOAR 6.10.0).

Related pull requests:
- 37207

Download

1.18.5 - 1841503 (December 19, 2024)

Scripts

SearchIncidentsV2

Documentation and metadata improvements.

CopyNotesToIncident

Fixed an issue where indicators were auto-extracted from the copied notes regardless of the value of the auto_extract argument.
Updated the Docker image to: demisto/python3:3.11.10.116949.

New: CommandLineAnalysis

New: This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:
0-25: Low Risk
26-50: Medium Risk
51-90: High Risk
91-100: Critical Risk
The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.

Related pull requests:
- 37611

Download

1.18.2 - 1834150 (December 18, 2024)

Scripts

New: MITRENameByID_Formatter

New: Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).

IndicatorMaliciousRatioCalculation

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

RunPollingCommand

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

ExtractIndicatorsFromTextFile

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

NumberOfPhishingAttemptPerUser

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

DeleteContext

Documentation and metadata improvements.

CopyContextToField

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

ExtractIndicatorsFromWordFile

Documentation and metadata improvements.

SetAndHandleEmpty

Documentation and metadata improvements.

CompareIncidentsLabels

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

findIncidentsWithIndicator

Documentation and metadata improvements.

MarkRelatedIncidents

Documentation and metadata improvements.

DockerHardeningCheck

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

GetDuplicatesMlv2

Documentation and metadata improvements.

SetByIncidentId

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

SearchIncidentsV2

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

FindSimilarIncidents

Documentation and metadata improvements.

Related pull requests:
- 37760

Download

1.17.7 - 1796926 (December 12, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.1791788.

Related pull requests:
- 37653

Download

1.17.6 - 1793696 (December 11, 2024)

Scripts

FormatURL

Fixed an issue where URLs were not parsed correctly when handling nested parenthesis in the URL query.

ExportToXLSX

Updated the Docker image to: demisto/xslxwriter:1.0.0.117330.

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.117469.

ReadQRCode

Updated the Docker image to: demisto/qrcode:1.0.0.117542.

Related pull requests:
- 37639

Download

1.17.4 - 1780397 (December 9, 2024)

Scripts

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

ParseHTMLIndicators

Updated the Docker image to: demisto/bs4-tld:1.0.0.117606.

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

Related pull requests:
- 37620
- 37619
- 37618
- 37617

Download

1.17.3 - 1775999 (December 9, 2024)

Scripts

StixCreator

Updated the parsing logic for the autonomous system indicator. When the indicator value is a number, it will be converted to a string.

Related pull requests:
- 37563
- 37449

Download

1.17.2 - 1773546 (December 8, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.118060.

Related pull requests:
- 37607

Download

1.17.1 - 1752502 (December 4, 2024)

Scripts

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.117518.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.117518.

Related pull requests:
- 37544
- 37543
- 37541
- 37542

Download

1.17.0 - 1745299 (December 3, 2024)

Scripts

get-user-data

Updated the script to ensure that all data returned from each command is also returned to the context.
Updated the script to include the source of the data in the context for each field.

ExtractIndicatorsFromWordFile

Internal code improvements.

Related pull requests:
- 37431

Download

1.15.99 - 1741355 (December 3, 2024)

Scripts

StixCreator

Fixed an issue where indicators without names were not properly parsed.

Related pull requests:
- 36027

Download

1.15.98 - 1738579 (December 2, 2024)

Scripts

ExportToCSV

Improved consistency of the script output by removing carriage return (\r) characters from the end of lines.

SetGridField

Updated the Docker image to: demisto/pandas:1.0.0.117209.

GenerateAsBuilt

Updated the Docker image to: demisto/teams:1.0.0.116912.

Related pull requests:
- 37425
- 37421
- 37419
- 37422
- 37418
- 37420

Download

1.15.96 - 1731907 (December 1, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.117740.

New: clear-user-session

Added the clear-user-session script to clear user sessions from multiple integrations.

Related pull requests:
- 37255

Download

1.15.94 - 1709192 (November 26, 2024)

Scripts

CertificateExtract

Updated the Docker image to: demisto/crypto:1.0.0.114611.

Related pull requests:
- 37418
- 37425
- 37419
- 37421
- 37420
- 37353
- 37375
- 37422

Download

1.15.93 - 1699115 (November 25, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

ExtractHTMLTables

Updated the Docker image to: demisto/bs4-py3:1.0.0.117152.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

Related pull requests:
- 37378
- 37355
- 37356
- 37357

Download

1.15.92 - 1696672 (November 24, 2024)

Scripts

ReadPDFFileV2

Fixed an issue where the script failed to handle binary data in PDF annotation objects.

Related pull requests:
- 37408

Download

1.15.91 - 1673120 (November 19, 2024)

Scripts

VerifyJSON

Updated the Docker image to: demisto/powershell:7.4.6.116823.

Related pull requests:
- 37287
- 37283

Download

1.15.90 - 1666862 (November 18, 2024)

Scripts

VerifyJSON

Updated the Docker image to: demisto/powershell:7.4.2.103657.

Related pull requests:
- 37214
- 37193

Download

1.15.89 - 1663384 (November 18, 2024)

Scripts

ConvertXmlFileToJson

Updated the Docker image to: demisto/xml-feed:1.0.0.116765.

Related pull requests:
- 37225
- 37222

Download

1.15.88 - 1647729 (November 14, 2024)

Scripts

DeduplicateValuesbyKey

Updated the Docker image to: demisto/python3:3.11.10.115186.

SendEmailOnSLABreach

Updated the Docker image to: demisto/python3:3.11.10.115186.

TimeStampCompare

Updated the Docker image to: demisto/python3:3.11.10.115186.

URLNumberOfAds

Updated the Docker image to: demisto/python3:3.11.10.115186.

DisplayHTML

Updated the Docker image to: demisto/python3:3.11.10.115186.

VerdictResult

Updated the Docker image to: demisto/python3:3.11.10.115186.

IsListExist

Updated the Docker image to: demisto/python3:3.11.10.115186.

LookupCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetIndicatorDBotScore

Updated the Docker image to: demisto/python3:3.11.10.115186.

ZipStrings

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreateIndicatorsFromSTIX

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetLicenseID

Updated the Docker image to: demisto/python3:3.11.10.115186.

hideFieldsOnNewIncident

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExportIncidentsToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

ResolveShortenedURL

Updated the Docker image to: demisto/python3:3.11.10.115186.

SearchIndicator

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractIndicatorsFromTextFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

Base64EncodeV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

VerifyIPv6Indicator

Updated the Docker image to: demisto/python3:3.11.10.115186.

ReadFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintErrorEntry

Updated the Docker image to: demisto/python3:3.11.10.115186.

SCPPullFiles

Updated the Docker image to: demisto/python3:3.11.10.115186.

DecodeMimeHeader

Updated the Docker image to: demisto/python3:3.11.10.115186.

HTTPListRedirects

Updated the Docker image to: demisto/python3:3.11.10.115186.

StopTimeToAssignOnOwnerChange

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetMultipleValues

Updated the Docker image to: demisto/python3:3.11.10.115186.

ConvertCountryCodeCountryName

Updated the Docker image to: demisto/python3:3.11.10.115186.

ParseCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

SearchIncidentsSummary

Updated the Docker image to: demisto/python3:3.11.10.115186.

CertificateReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

BMCTool

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckIndicatorValue

Updated the Docker image to: demisto/python3:3.11.10.115186.

AddKeyToList

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChangeRemediationSLAOnSevChange

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetInstances

Updated the Docker image to: demisto/python3:3.11.10.115186.

IdentifyAttachedEmail

Updated the Docker image to: demisto/python3:3.11.10.115186.

JSONtoCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreateHash

Updated the Docker image to: demisto/python3:3.11.10.115186.

DumpJSON

Updated the Docker image to: demisto/python3:3.11.10.115186.

ServerLogs_docker

Updated the Docker image to: demisto/python3:3.11.10.115186.

ScheduleGenericPolling

Updated the Docker image to: demisto/python3:3.11.10.115186.

ConvertTimezoneFromUTC

Updated the Docker image to: demisto/python3:3.11.10.115186.

GridFieldSetup

Updated the Docker image to: demisto/python3:3.11.10.115186.

TextFromHTML

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetIndicatorGridField

Updated the Docker image to: demisto/python3:3.11.10.115186.

enrich_exclude_button

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrettyPrint

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckSenderDomainDistance

Updated the Docker image to: demisto/python3:3.11.10.115186.

Base64ListToFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

DomainReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

CopyNotesToIncident

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetWithTemplate

Updated the Docker image to: demisto/python3:3.11.10.115186.

UtilAnyResults

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChangeContext

Updated the Docker image to: demisto/python3:3.11.10.115186.

cveReputationV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

MaliciousRatioReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractEmailV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

FeedRelatedIndicatorsWidget

Updated the Docker image to: demisto/python3:3.11.10.115186.

ArrayToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

DisplayHTMLWithImages

Updated the Docker image to: demisto/python3:3.11.10.115186.

ParseYAML

Updated the Docker image to: demisto/python3:3.11.10.115186.

IsolationAssetWrapper

Updated the Docker image to: demisto/python3:3.11.10.115186.

GeneratePassword

Updated the Docker image to: demisto/python3:3.11.10.115186.

DisableUserWrapper

Updated the Docker image to: demisto/python3:3.11.10.115186.

StringSimilarity

Updated the Docker image to: demisto/python3:3.11.10.115186.

PortListenCheck

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintContext

Updated the Docker image to: demisto/python3:3.11.10.115186.

ShowIncidentIndicators

Updated the Docker image to: demisto/python3:3.11.10.115186.

JSONFileToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckContextValue

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetStringsDistance

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetServerURL

Updated the Docker image to: demisto/python3:3.11.10.115186.

IPReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

OnionURLReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

URLSSLVerification

Updated the Docker image to: demisto/python3:3.11.10.115186.

AppendindicatorFieldWrapper

Updated the Docker image to: demisto/python3:3.11.10.115186.

StopScheduledTask

Updated the Docker image to: demisto/python3:3.11.10.115186.

URLReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

ServerLogs

Updated the Docker image to: demisto/python3:3.11.10.115186.

get-user-data

Updated the Docker image to: demisto/python3:3.11.10.115186.

PositiveDetectionsVSDetectionEngines

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExportAuditLogsToFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

RunPollingCommand

Updated the Docker image to: demisto/python3:3.11.10.115186.

RunDockerCommand

Updated the Docker image to: demisto/python3:3.11.10.115186.

DBotAverageScore

Updated the Docker image to: demisto/python3:3.11.10.115186.

FilterByList

Updated the Docker image to: demisto/python3:3.11.10.115186.

RemoveKeyFromList

Updated the Docker image to: demisto/python3:3.11.10.115186.

CalculateEntropy

Updated the Docker image to: demisto/python3:3.11.10.115186.

GenerateAsBuiltConfiguration

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractAttackPattern

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetEnabledInstances

Updated the Docker image to: demisto/python3:3.11.10.115186.

SearchIncidentsV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

EmailReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

FileCreateAndUploadV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintRaw

Updated the Docker image to: demisto/python3:3.11.10.115186.

IsUrlPartOfDomain

Updated the Docker image to: demisto/python3:3.11.10.115186.

ProvidesCommand

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetFieldsByIncidentType

Updated the Docker image to: demisto/python3:3.11.10.115186.

ReplaceMatchGroup

Updated the Docker image to: demisto/python3:3.11.10.115186.

VerifyCIDR

Updated the Docker image to: demisto/python3:3.11.10.115186.

MatchRegexV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.115186.

cvss_color

Updated the Docker image to: demisto/python3:3.11.10.115186.

Strings

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetListRow

Updated the Docker image to: demisto/python3:3.11.10.115186.

IncidentFields

Updated the Docker image to: demisto/python3:3.11.10.115186.

ShowLocationOnMap

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetIndicatorDBotScoreFromCache

Updated the Docker image to: demisto/python3:3.11.10.115186.

FileReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetEntries

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckFieldValue

Updated the Docker image to: demisto/python3:3.11.10.115186.

RepopulateFiles

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetDockerImageLatestTag

Updated the Docker image to: demisto/python3:3.11.10.115186.

AnalyzeTimestampIntervals

Updated the Docker image to: demisto/python3:3.11.10.115186.

LoadJSON

Updated the Docker image to: demisto/python3:3.11.10.115186.

TopMaliciousRatioIndicators

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExportIndicatorsToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

BreachConfirmationHTML

Updated the Docker image to: demisto/python3:3.11.10.115186.

ListUsedDockerImages

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetDataCollectionLink

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetTime

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetErrorsFromEntry

Updated the Docker image to: demisto/python3:3.11.10.115186.

FormatURL

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreateNewIndicatorsOnly

Updated the Docker image to: demisto/python3:3.11.10.115186.

FileToBase64List

Updated the Docker image to: demisto/python3:3.11.10.115186.

MarkAsNoteByTag

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37147
- 37137
- 37136
- 37140
- 37138
- 37139

Download

1.15.87 - 1631266 (November 12, 2024)

Scripts

displayMappedFields

Fixed an misalignment issue when field values contains "|" character.
Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37176

Download

1.15.86 - 1627458 (November 12, 2024)

Scripts

SetMultipleValues

Updated the Docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 35282

Download

1.15.85 - 1621428 (November 11, 2024)

Scripts

DBotUpdateLogoURLPhishing

Updated the Docker image to: demisto/mlurlphishing:1.0.0.115323.

Related pull requests:
- 37153

Download

1.15.84 - 1619437 (November 10, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where email addresses with commas in the display name were not parsed correctly.
Updated the Docker image to: demisto/parse-emails:1.0.0.115640.

Related pull requests:
- 37135

Download

1.15.83 - 1615839 (November 10, 2024)

Scripts

Ping

Updated the Docker image to: demisto/netutils:1.0.0.115452.

Dig

Updated the Docker image to: demisto/netutils:1.0.0.115452.

GetDomainDNSDetails

Updated the Docker image to: demisto/netutils:1.0.0.115452.

HTMLtoMD

Updated the Docker image to: demisto/btfl-soup:1.0.1.115405.

ContentPackInstaller

Updated the Docker image to: demisto/xsoar-tools:1.0.0.115559.

Related pull requests:
- 37108
- 37122
- 37109
- 37115
- 37124
- 37111

Download

1.15.81 - 1605511 (November 7, 2024)

Scripts

PreProcessImage

Updated the Docker image to: demisto/processing-image-file:1.0.0.115372.

Related pull requests:
- 37103
- 37093

Download

1.15.80 - 1602991 (November 6, 2024)

Scripts

ParseExcel

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

DownloadAndArchivePythonLibrary

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

FetchIndicatorsFromFile

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExtractFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ZipFile

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

StixCreator

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExifRead

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExtractDomainFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

LanguageDetect

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExtractDomainAndFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

cvss_color

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckSenderDomainDistance

Updated the Docker image to: demisto/python3:3.11.10.113941.

DisplayHTMLWithImages

Updated the Docker image to: demisto/python3:3.11.10.113941.

Base64EncodeV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

ResolveShortenedURL

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.113941.

CloseInvestigationAsDuplicate

Updated the Docker image to: demisto/python3:3.11.10.113941.

Strings

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckIndicatorValue

Updated the Docker image to: demisto/python3:3.11.10.113941.

DisableUserWrapper

Updated the Docker image to: demisto/python3:3.11.10.113941.

ChangeContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetDockerImageLatestTag

Updated the Docker image to: demisto/python3:3.11.10.113941.

AnalyzeTimestampIntervals

Updated the Docker image to: demisto/python3:3.11.10.113941.

IPToHost

Updated the Docker image to: demisto/python3:3.11.10.113941.

ShowLocationOnMap

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExportIndicatorsToCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

StopTimeToAssignOnOwnerChange

Updated the Docker image to: demisto/python3:3.11.10.113941.

ChangeRemediationSLAOnSevChange

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetDataCollectionLink

Updated the Docker image to: demisto/python3:3.11.10.113941.

GenerateAsBuiltConfiguration

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExtractAttackPattern

Updated the Docker image to: demisto/python3:3.11.10.113941.

GenerateRandomString

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExportContextToJSONFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

ReadFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

ScheduleGenericPolling

Updated the Docker image to: demisto/python3:3.11.10.113941.

ContextContains

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreateHash

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsolationAssetWrapper

Updated the Docker image to: demisto/python3:3.11.10.113941.

SearchIncidentsV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

GeneratePassword

Updated the Docker image to: demisto/python3:3.11.10.113941.

HTTPListRedirects

Updated the Docker image to: demisto/python3:3.11.10.113941.

LoadJSONFileToContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreateNewIndicatorsOnly

Updated the Docker image to: demisto/python3:3.11.10.113941.

AddDBotScoreToContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetMultipleValues

Updated the Docker image to: demisto/python3:3.11.10.113941.

FeedRelatedIndicatorsWidget

Updated the Docker image to: demisto/python3:3.11.10.113941.

GenerateRandomUUID

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetTime

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrettyPrint

Updated the Docker image to: demisto/python3:3.11.10.113941.

cveReputationV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

VerifyCIDR

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsListExist

Updated the Docker image to: demisto/python3:3.11.10.113941.

get-user-data

Updated the Docker image to: demisto/python3:3.11.10.113941.

LookupCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

DomainReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

SCPPullFiles

Updated the Docker image to: demisto/python3:3.11.10.113941.

ParseCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

AppendindicatorFieldWrapper

Updated the Docker image to: demisto/python3:3.11.10.113941.

CVSSCalculator

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetEntries

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExportAuditLogsToFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

MaliciousRatioReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

ZipStrings

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckContextValue

Updated the Docker image to: demisto/python3:3.11.10.113941.

displayUtilitiesResults

Updated the Docker image to: demisto/python3:3.11.10.113941.

RepopulateFiles

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckFieldValue

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsUrlPartOfDomain

Updated the Docker image to: demisto/python3:3.11.10.113941.

ConvertCountryCodeCountryName

Updated the Docker image to: demisto/python3:3.11.10.113941.

GenerateSummaryReportButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

ConvertDatetoUTC

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsDomainInternal

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetEnabledInstances

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetServerURL

Updated the Docker image to: demisto/python3:3.11.10.113941.

DumpJSON

Updated the Docker image to: demisto/python3:3.11.10.113941.

TimeStampCompare

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.113941.

CompareLists

Updated the Docker image to: demisto/python3:3.11.10.113941.

ConvertTimezoneFromUTC

Updated the Docker image to: demisto/python3:3.11.10.113941.

TextFromHTML

Updated the Docker image to: demisto/python3:3.11.10.113941.

ServerLogs_docker

Updated the Docker image to: demisto/python3:3.11.10.113941.

CalculateEntropy

Updated the Docker image to: demisto/python3:3.11.10.113941.

DockerHardeningCheck

Updated the Docker image to: demisto/python3:3.11.10.113941.

ListUsedDockerImages

Updated the Docker image to: demisto/python3:3.11.10.113941.

IncidentFields

Updated the Docker image to: demisto/python3:3.11.10.113941.

FilterByList

Updated the Docker image to: demisto/python3:3.11.10.113941.

FileReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

URLSSLVerification

Updated the Docker image to: demisto/python3:3.11.10.113941.

NumberOfPhishingAttemptPerUser

Updated the Docker image to: demisto/python3:3.11.10.113941.

PortListenCheck

Updated the Docker image to: demisto/python3:3.11.10.113941.

URLReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsInternalHostName

Updated the Docker image to: demisto/python3:3.11.10.113941.

URLNumberOfAds

Updated the Docker image to: demisto/python3:3.11.10.113941.

JSONtoCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

IPReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

ReplaceMatchGroup

Updated the Docker image to: demisto/python3:3.11.10.113941.

TopMaliciousRatioIndicators

Updated the Docker image to: demisto/python3:3.11.10.113941.

UtilAnyResults

Updated the Docker image to: demisto/python3:3.11.10.113941.

ServerLogs

Updated the Docker image to: demisto/python3:3.11.10.113941.

OnionURLReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

enrich_exclude_button

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetFieldsByIncidentType

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetDateField

Updated the Docker image to: demisto/python3:3.11.10.113941.

AssignToMeButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

AddKeyToList

Updated the Docker image to: demisto/python3:3.11.10.113941.

PopulateCriticalAssets

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExtractEmailV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

SearchIncidentsSummary

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsIPPrivate

Updated the Docker image to: demisto/python3:3.11.10.113941.

FileToBase64List

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsInternalDomainName

Updated the Docker image to: demisto/python3:3.11.10.113941.

FileCreateAndUploadV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

RemoveKeyFromList

Updated the Docker image to: demisto/python3:3.11.10.113941.

DecodeMimeHeader

Updated the Docker image to: demisto/python3:3.11.10.113941.

DeduplicateValuesbyKey

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExtractIndicatorsFromTextFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

LoadJSON

Updated the Docker image to: demisto/python3:3.11.10.113941.

BreachConfirmationHTML

Updated the Docker image to: demisto/python3:3.11.10.113941.

DBotAverageScore

Updated the Docker image to: demisto/python3:3.11.10.113941.

CalculateTimeDifference

Updated the Docker image to: demisto/python3:3.11.10.113941.

SSDeepReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

MarkAsNoteByTag

Updated the Docker image to: demisto/python3:3.11.10.113941.

ShowIncidentIndicators

Updated the Docker image to: demisto/python3:3.11.10.113941.

displayMappedFields

Updated the Docker image to: demisto/python3:3.11.10.113941.

MarkAsEvidenceByTag

Updated the Docker image to: demisto/python3:3.11.10.113941.

EncodeToAscii

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintRaw

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetStringsDistance

Updated the Docker image to: demisto/python3:3.11.10.113941.

HttpV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetIndicatorGridField

Updated the Docker image to: demisto/python3:3.11.10.113941.

IndicatorMaliciousRatioCalculation

Updated the Docker image to: demisto/python3:3.11.10.113941.

EmailReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintErrorEntry

Updated the Docker image to: demisto/python3:3.11.10.113941.

GridFieldSetup

Updated the Docker image to: demisto/python3:3.11.10.113941.

JSONFileToCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetIndicatorDBotScore

Updated the Docker image to: demisto/python3:3.11.10.113941.

CopyNotesToIncident

Updated the Docker image to: demisto/python3:3.11.10.113941.

MatchRegexV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

IdentifyAttachedEmail

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetInstances

Updated the Docker image to: demisto/python3:3.11.10.113941.

ArrayToCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

EditServerConfig

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetErrorsFromEntry

Updated the Docker image to: demisto/python3:3.11.10.113941.

CopyContextToField

Updated the Docker image to: demisto/python3:3.11.10.113941.

DisplayHTML

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetLicenseID

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetIndicatorDBotScoreFromCache

Updated the Docker image to: demisto/python3:3.11.10.113941.

DemistoVersion

Updated the Docker image to: demisto/python3:3.11.10.113941.

StringSimilarity

Updated the Docker image to: demisto/python3:3.11.10.113941.

ParseYAML

Updated the Docker image to: demisto/python3:3.11.10.113941.

VerifyIPv6Indicator

Updated the Docker image to: demisto/python3:3.11.10.113941.

StopScheduledTask

Updated the Docker image to: demisto/python3:3.11.10.113941.

RunDockerCommand

Updated the Docker image to: demisto/python3:3.11.10.113941.

RunPollingCommand

Updated the Docker image to: demisto/python3:3.11.10.113941.

BMCTool

Updated the Docker image to: demisto/python3:3.11.10.113941.

VerdictResult

Updated the Docker image to: demisto/python3:3.11.10.113941.

hideFieldsOnNewIncident

Updated the Docker image to: demisto/python3:3.11.10.113941.

CompareIncidentsLabels

Updated the Docker image to: demisto/python3:3.11.10.113941.

PositiveDetectionsVSDetectionEngines

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetWithTemplate

Updated the Docker image to: demisto/python3:3.11.10.113941.

Base64ListToFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

SearchIndicator

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreateIndicatorsFromSTIX

Updated the Docker image to: demisto/python3:3.11.10.113941.

FormatURL

Updated the Docker image to: demisto/python3:3.11.10.113941.

SendEmailOnSLABreach

Updated the Docker image to: demisto/python3:3.11.10.113941.

LinkIncidentsButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetListRow

Updated the Docker image to: demisto/python3:3.11.10.113941.

CertificateReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

LinkIncidentsWithRetry

Updated the Docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 36995
- 37051
- 37052
- 36992
- 37006
- 36997
- 36994
- 36998
- 36993
- 37059

Download

1.15.79 - 1597102 (November 5, 2024)

Scripts

JsonUnescape

Updated the Docker image to: demisto/python3-deb:3.11.10.114849.

Related pull requests:
- 37046
- 37042
- 37041

Download

1.15.78 - 1592987 (November 5, 2024)

Scripts

SearchIncidentsV2

Documentation and metadata improvements.

Related pull requests:
- 37048

Download

1.15.77 - 1574765 (October 31, 2024)

Scripts

FailedInstances

Fixed an issue where the script was ignoring instances in an error state.

Related pull requests:
- 37004

Download

1.15.76 - 1563308 (October 29, 2024)

Scripts

SSDeepSimilarity

Updated the Docker image to: demisto/ssdeep:1.0.0.114703.

Related pull requests:
- 36856
- 36845
- 36844
- 36843
- 36840
- 36837
- 36836
- 36832
- 36842
- 36841
- 36839
- 36838
- 36834
- 36835
- 36833

Download

1.15.75 - 1537605 (October 22, 2024)

Scripts

PreProcessImage

Updated the Docker image to: demisto/processing-image-file:1.0.0.113909.

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.113908.

Related pull requests:
- 36780
- 36769
- 36784
- 36766
- 36771
- 36498
- 36747
- 36773
- 36759
- 36725
- 36774
- 35865

Download

1.15.74 - 1533081 (October 21, 2024)

Scripts

SearchIncidentsV2

Updated the Docker image to: demisto/python3:3.11.10.111526.

Related pull requests:
- 35865

Download

1.15.73 - 1504524 (October 14, 2024)

Scripts

SSDeepSimilarity

Updated the Docker image to: demisto/ssdeep:1.0.0.112284.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.112283.

JsonUnescape

Updated the Docker image to: demisto/python3-deb:3.11.10.112166.

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.112283.

UnzipFile

Updated the Docker image to: demisto/unzip:1.0.0.112289.

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.112272.

ReadQRCode

Updated the Docker image to: demisto/qrcode:1.0.0.112357.

Related pull requests:
- 36505
- 36495
- 36494
- 36493
- 36492
- 36491
- 36490
- 36489
- 36486
- 36485
- 36484
- 36483
- 36488
- 36487

Download

1.15.72 - 1491068 (October 10, 2024)

Scripts

SearchIncidentsV2

Fixed an issue (typo)

Related pull requests:
- 36667
- 36664

Download

1.15.71 - 1487718 (October 9, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where attachment file name encoded in windows-874 could not be parsed correctly.
Updated the Docker image to: demisto/parse-emails:1.0.0.113216.

Related pull requests:
- 36629

Download

1.15.70 - 1480610 (October 8, 2024)

Scripts

New: get-user-data

New: This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context. (Available from Cortex XSOAR 6.10.0).

ShowIncidentIndicators

Fixed an issue with ShowIncidentIndicators fetching indicators with the same IDs.
Updated the Docker image to: demisto/python3:3.11.10.111526.

Related pull requests:
- 36260
- 36657

Download

1.15.68 - 1477969 (October 8, 2024)

Scripts

SearchIncidentsV2

Fixed an issue when asking for a summarized version of found incidents would not show properly in XSIAM.

Related pull requests:
- 36650
- 36631

Download

1.15.67 - 1475337 (October 7, 2024)

Scripts

IdentifyAttachedEmail

Fixed an issue where files of type 'message/rfc822' were not identified as emails.

Related pull requests:
- 36620

Download

1.15.66 - 1470320 (October 6, 2024)

Scripts

DeleteContext

Fixed an issue where DBotScore key was not excluded from deletion.

Related pull requests:
- 36594

Download

1.15.65 - 1457639 (October 1, 2024)

Scripts

StixCreator

Enhanced TAXII2FeedApiModule to support setting indicator enrichment exclusion in select feeds. The change has no impact on this script.

Related pull requests:
- 36445

Download

1.15.64 - 1434344 (September 25, 2024)

Scripts

ExtractDomainAndFQDNFromUrlAndEmail

Updated the formatter to avoid ".onion" domains.

New: AnalyzeTimestampIntervals

New: This script analyzes Unix timestamps to detect patterns of automation, focusing on consistent intervals and high frequency.

Related pull requests:
- 36082

Download

1.15.62 - 1419889 (September 23, 2024)

Incident Fields

Breach Confirmation
Added support for IBM QRadar SOAR Incident in the Breach Confirmation field.

Related pull requests:
- 35286

Download

1.15.61 - 1378119 (September 12, 2024)

Scripts

DeleteContext

Fixed an issue where in some cases the script ignored the keysToKeep argument.

Related pull requests:
- 36292

Download

1.15.60 - 1368468 (September 10, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Fixed an issue where the script failed to detect files with uppercase or mixed-case extensions (e.g., .Xlsx).

Related pull requests:
- 36193

Download

1.15.59 - 1358619 (September 8, 2024)

Scripts

StixCreator

Fixed an issue where the fetch-indicators command failed to parse nested reports indicators correctly in the Unit42v2 Feed.

enrich_exclude_button

Updated the script description.

Related pull requests:
- 36024

Download

1.15.57 - 1350055 (September 5, 2024)

Scripts

GetEntries

Added the following arguments:
- page_size
- last_id
- first_id
- selected_entry_id
- users
- tags_and_operator
- from_time
- parent_id
Updated the Docker image to: demisto/python3:3.11.9.109226.

Related pull requests:
- 36114
- 36150

Download

1.15.56 - R1340401 (September 3, 2024)

Scripts

ExtractFQDNFromUrlAndEmail

Documentation and metadata improvements.
Updated the Docker image to: demisto/py3-tools:1.0.0.108682.

ExtractDomainAndFQDNFromUrlAndEmail

Documentation and metadata improvements.
Updated the Docker image to: demisto/py3-tools:1.0.0.108682.

Related pull requests:
- 36053

Download

1.15.55 - 1316088 (August 27, 2024)

Scripts

ScheduleGenericPolling

Fixed an issue where the script would fail in case one of the arguments: additionalPollingCommandArgNames or additionalPollingCommandArgValues was not given.

Related pull requests:
- 36036

Download

1.15.54 - 1311942 (August 26, 2024)

Scripts

ScheduleGenericPolling

Fixed an issue where the script failed when given values containing quotation marks.
Updated the Docker image to: demisto/python3:3.11.9.107902.

GenericPollingScheduledTask

Fixed an issue where the script failed when given values containing quotation marks.

Related pull requests:
- 35995

Download

1.15.53 - 1284734 (August 18, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35705

Download

1.15.52 - 1277948 (August 15, 2024)

Scripts

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.108439.

Related pull requests:
- 35899

Download

1.15.51 - 1271135 (August 14, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where UTF-8 encoded EML files with 8-bit Content-Transfer-Encoding headers could not be parsed correctly.
Updated the Docker image to: demisto/parse-emails:1.0.0.108364.

Related pull requests:
- 35853

Download

1.15.50 - 1265696 (August 12, 2024)

Scripts

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

Related pull requests:
- 35403

Download

1.15.49 - 1262174 (August 11, 2024)

Scripts

FileToBase64List

Improved implementation to prevent the script from running in a new docker container for each call.
Updated the Docker image to: demisto/python3:3.11.9.107902.

Related pull requests:
- 35481

Download

1.15.48 - 1259921 (August 11, 2024)

Scripts

FindSimilarIncidents

Maintenance and stability enhancements.

Related pull requests:
- 35643

Download

1.15.47 - 1257268 (August 9, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where parsing p7m files fails to remove signature.
Updated the Docker image to: demisto/parse-emails:1.0.0.107885.

Related pull requests:
- 35796

Download

1.15.46 - 1256255 (August 8, 2024)

Scripts

DockerHardeningCheck

Internal code improvements.
Updated the Docker image to: demisto/python3:3.11.9.107421.

Related pull requests:
- 35801

Download

1.15.45 - 1252429 (August 7, 2024)

Scripts

IsIntegrationAvailable

Fixed an issue where the script would return an error when the raw-response argument was provided.

Related pull requests:
- 35787

Download

1.15.44 - 1244506 (August 5, 2024)

Scripts

DeleteContext

Performance improvements.

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.106927.

Related pull requests:
- 35732

Download

1.15.42 - 1242168 (August 5, 2024)

Scripts

ContentPackInstaller

Added clearer error messages for cases the script fails.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.104430.

Related pull requests:
- 35622

Download

1.15.41 - 1238470 (August 4, 2024)

Scripts

DisplayHTMLWithImages

Fixed an issue where in XSOAR 8, embedded images did not display in the Email Body section in the Phishing layout.
Updated the Docker image to: demisto/python3:3.11.9.105369.

Related pull requests:
- 35702

Download

1.15.40 - 1230534 (July 31, 2024)

Scripts

FailedInstances

Fixed an issue where the script failed when a ServiceNow CMDB instance was configured with OAuth flow enabled.

Related pull requests:
- 35694

Download

1.15.39 - 1226445 (July 30, 2024)

Scripts

DBotUpdateLogoURLPhishing

Maintenance and stability enhancements.

Related pull requests:
- 35570

Download

1.15.38 - 1218660 (July 28, 2024)

Scripts

IdentifyAttachedEmail

Fixed an issue in which email attachments were not identified in Cortex XSOAR 8.
Fixed an issue in which only one entry ID was added to the context.
Updated the docker image to demisto/python3:3.11.9.104657.

Related pull requests:
- 35569

Download

1.15.37 - 1208894 (July 24, 2024)

Scripts

DisplayHTMLWithImages

Fixed an issue where some embedded images not appear in the Email Body section in the Phishing incident layout.
Updated the Docker image to: demisto/python3:3.11.9.104657.

Related pull requests:
- 35566

Download

1.15.36 - 1206393 (July 24, 2024)

Scripts

New: SetIndicatorGridField

New script to allow you to easily set an indicator grid field.

Related pull requests:
- 35553

Download

1.15.35 - 1204731 (July 23, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.104899.

Related pull requests:
- 35567

Download

1.15.34 - 1200812 (July 22, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35547

Download

1.15.33 - 1198326 (July 22, 2024)

Scripts

WordTokenizer

Deprecated. Use DBotPreProcessTextData instead.

Related pull requests:
- 35511

Download

1.15.32 - 1191003 (July 18, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 35468

Download

1.15.31 - 1179382 (July 15, 2024)

Scripts

LookupCSV

Fixed an issue where the script results were added to LookupCSV.result instead of LookupCSV.Result in the context.
Updated the Docker image to: demisto/python3:3.11.9.103066.

Related pull requests:
- 35418

Download

1.15.30 - 1177096 (July 15, 2024)

Scripts

ExportToCSV

Updated the script to handle the issue of encoding non english characters while loading the CSV file in the Microsoft excel sheet. Added a new argument 'codec' to choose between UTF-8 and UTF-16-BOM.

Related pull requests:
- 35407
- 35297

Download

1.15.29 - 1175817 (July 14, 2024)

Scripts

DBotUpdateLogoURLPhishing

Updated the Docker image to: demisto/mlurlphishing:1.0.0.103417.

New: GenerateAsBuiltConfiguration

New: Generate a JSON file that can be downloaded and used to create the As-Built document for Cortex XSOAR. (Available from Cortex XSOAR 6.10.0).

Related pull requests:
- 35178
- 35115

Download

1.15.27 - 1173616 (July 14, 2024)

Scripts

DisplayHTMLWithImages

Fixed an issue where there was no default text color, and now the default is black.
Updated the Docker image to: demisto/python3:3.11.9.103066.

Related pull requests:
- 35367

Download

1.15.26 - 1169083 (July 11, 2024)

Scripts

VerifyIPv6Indicator

Updated the IPv6 formatter to remove unneeded prefixed characters.
Updated the Docker image to: demisto/python3:3.10.14.101217.

DisplayHTMLWithImages

Fixed an issue where embedded images not appear in the Email Body section in the Phishing incident layout.
Updated the Docker image to: demisto/python3:3.10.14.99474.

Related pull requests:
- 35135

Download

1.15.24 - 1164474 (July 10, 2024)

Scripts

SetGridField

Updated the Docker image to: demisto/pandas:1.0.0.102566.

Related pull requests:
- 35339

Download

1.15.23 - 1159246 (July 8, 2024)

Scripts

ExportAuditLogsToFile

Fixed an issue with Cortex XSOAR 6.x where the command would fail by sending the wrong request.
Updated the Docker image to: demisto/python3:3.10.14.101217.

Related pull requests:
- 35280

Download

1.15.22 - 1156543 (July 8, 2024)

Scripts

ParseCSV

Fixed an issue where passing no escapechar would result in failure.
Updated the Docker image to: demisto/python3:3.10.14.99865.

Related pull requests:
- 33951

Download

1.15.21 - 1150618 (July 5, 2024)

Scripts

New: DownloadAndArchivePythonLibrary

New: The script downloads a Python library using PIP, archives it, and returns the file to the war room.
(Available from Cortex XSOAR 6.10.0).

Related pull requests:
- 33742

Download

1.15.20 - 1149551 (July 4, 2024)

Scripts

ContentPackInstaller

Updated the Docker image to: demisto/xsoar-tools:1.0.0.99061.

Related pull requests:
- 35232

Download

1.15.19 - 1142826 (July 2, 2024)

Scripts

ExtractIndicatorsFromTextFile

Fixed an issue where the outputs were not displayed in the context data.
Updated the Docker image to: demisto/python3:3.10.14.99865.

Related pull requests:
- 35179

Download

1.15.18 - 1135833 (June 30, 2024)

Scripts

ReadQRCode

Fixed an issue where indicators were not extracted from the output.

Related pull requests:
- 35110

Download

1.15.17 - 1126229 (June 26, 2024)

Scripts

ReadQRCode

Improved implementation of stderr redirection by removing wurlitzer.pipes() and redirecting stderr to a temporary file.
The automation now extracts QR codes exclusively to improve performance.
Updated the Docker image to: demisto/qrcode:1.0.0.98232.

Related pull requests:
- 34579

Download

1.15.16 - 1120391 (June 25, 2024)

Scripts

GridFieldSetup

Updated the script to include 10 additional inputs.

Related pull requests:
- 35016
- 35046

Download

1.15.15 - 1110626 (June 21, 2024)

Scripts

DisplayHTMLWithImages

Resolved a situation where there was no default background, and now the default background is white.
Updated the Docker image to: demisto/python3:3.10.14.98889.

Related pull requests:
- 34985

Download

1.15.14 - 1110034 (June 21, 2024)

Scripts

CreateEmailHtmlBody

Fixed an issue where the alerts field was not mapped in Cortex XSIAM.

Related pull requests:
- 34966

Download

1.15.13 - 1109132 (June 20, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 34979

Download

1.15.12 - 1104278 (June 19, 2024)

Scripts

FailedInstances

Fixed an issue where the script failed when a ServiceNow v2 instance was configured with OAuth flow enabled.

Related pull requests:
- 34871

Download

1.15.11 - 1103228 (June 18, 2024)

Scripts

ReadPDFFileV2

Fixed an issue where the script failed to open and extract the PDF's data.
Updated the Docker image to: demisto/readpdf:1.0.0.98214.

Related pull requests:
- 34908

Download

1.15.10 - 1098002 (June 17, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Added support for parsing grouped shapes in power point files.

Related pull requests:
- 34876

Download

1.15.9 - 1089105 (June 13, 2024)

Scripts

GetIndicatorDBotScoreFromCache

Added support for additional special characters that were not escaped properly.

Related pull requests:
- 34818

Download

1.15.8 - 1084629 (June 10, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 34765

Download

1.15.7 - 1082615 (June 10, 2024)

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 34804

Download

1.15.6 - 1072918 (June 5, 2024)

Scripts

GetListRow

Fixed an issue where new lines at the end of the list could lead to an exception.
Updated the Docker image to: demisto/python3:3.10.14.96411.

Related pull requests:
- 34652

Download

1.15.5 - 1067546 (June 4, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Fixed an issue where images with hyperlinks were not extracted properly from docx files.
Updated the Docker image to: demisto/office-utils:2.0.0.96781.

Related pull requests:
- 34671

Download

1.15.4 - 1063016 (June 2, 2024)

Scripts

FetchIndicatorsFromFile

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExifRead

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExtractDomainAndFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExtractFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

LanguageDetect

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

StixCreator

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExtractDomainFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ParseExcel

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

Related pull requests:
- 34465
- 33830
- 33831
- 33828
- 33825
- 33805
- 33871

Download

1.15.3 - 1057933 (May 30, 2024)

Scripts

GetIndicatorDBotScoreFromCache

Fixed an issue where not all special chars were escaped correctly.

Related pull requests:
- 34647

Download

1.15.2 - 1051712 (May 28, 2024)

Scripts

VerdictResult

Added support for Suspicious verdict.
Updated the Docker image to: demisto/python3:3.10.14.95956.

Related pull requests:
- 34575

Download

1.15.1 - 1049953 (May 28, 2024)

Scripts

GetIndicatorDBotScoreFromCache

Fixed an issue where some special chars of indicator values were not escaped correctly.
Updated the Docker image to: demisto/python3:3.10.14.95956.

Related pull requests:
- 34576

Download

1.15.0 - 1046017 (May 26, 2024)

Scripts

ZipFile

Replaced the pyminizip library with pyzipper.
Updated the Docker image to: demisto/py3-tools:1.0.0.95440.

Related pull requests:
- 34399

Download

1.14.49 - 1038463 (May 23, 2024)

Scripts

StixCreator

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34399
- 34484

Download

1.14.48 - 1029456 (May 20, 2024)

Scripts

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.93886.

DBotUpdateLogoURLPhishing

Updated the Docker image to: demisto/mlurlphishing:1.0.0.90588.

SSDeepSimilarity

Updated the Docker image to: demisto/ssdeep:1.0.0.93570.

PreProcessImage

Updated the Docker image to: demisto/processing-image-file:1.0.0.93358.

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.93318.

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.93351.

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.93363.

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.93886.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.93363.

Related pull requests:
- 34378

Download

1.14.47 - 1027410 (May 20, 2024)

Scripts

StixCreator

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34434

Download

1.14.46 - 1021616 (May 16, 2024)

Scripts

ScheduleGenericPolling

Fixed an issue where polling didn't reach into timeouts.

Related pull requests:
- 34357

Download

1.14.45 - 1005026 (May 8, 2024)

Scripts

SendEmailOnSLABreach

Updated the Docker image to: demisto/python3:3.10.14.92207.

Related pull requests:
- 34251

Download

1.14.44 - 1000160 (May 7, 2024)

Scripts

ParseEmailFilesV2

Documentation and metadata improvements.
Updated the Docker image to: demisto/parse-emails:1.0.0.93148.

Related pull requests:
- 33388

Download

1.14.43 - 998827 (May 6, 2024)

Common Scripts

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 34212

Download

1.14.42 - R995825 (May 5, 2024)

Scripts

Ping

Improved the error message to clarify that the script can only run on a custom engine on Cortex XSOAR 8 and Cortex XSIAM.
Updated the Docker image to: demisto/netutils:1.0.0.92795.

Related pull requests:
- 34167

Download

1.14.41 - 986039 (May 1, 2024)

Scripts

DeleteContext

Fixed an issue where results' object, contents' format, did not match actual content type.

Related pull requests:
- 34132

Download

1.14.40 - 978880 (April 26, 2024)

Scripts

FormatURL

Internal code adjustments.
Updated the Docker image to: demisto/python3:3.10.14.92207.

FindSimilarIncidents

Deprecated. Use the DBotFindSimilarIncidents script instead.

Related pull requests:
- 33245

Download

1.14.38 - 978218 (April 25, 2024)

Scripts

CreateNewIndicatorsOnly

Added the associate_to_current argument which associates the indicator with the current incident.

Related pull requests:
- 33907

Download

1.14.37 - 976988 (April 25, 2024)

Scripts

ParseEmailFilesV2

Added support for Apple HFS file type.
Updated the Docker image to: demisto/parse-emails:1.0.0.93148.

Related pull requests:
- 34084

Download

1.14.36 - 971504 (April 21, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where some eml files where not recognized.

Related pull requests:
- 34081

Download

1.14.35 - 970211 (April 21, 2024)

Scripts

FormatURL

Fixed an issue with microsoft safe links not being formatted correctly when the link had office365.us as a domain or a path as part of the wrapper.

Related pull requests:
- 34050

Download

1.19.45 - 3161494 (April 17, 2025)

Scripts

URLSSLVerification

Updated the SSL certificate verification for all redirect chain.
- If the initial URL is HTTP and redirects to HTTPS with a valid certificate, verified = True.
- If the entire redirect chain remains HTTP, verified = False.
set_http_as_suspicious updated logics.
- if set_http_as_suspicious='true' and the URL is http then DbotScore = Suspicious.
- if set_http_as_suspicious='true' and the URL is https DbotScore = Unknown.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39533

Download

1.19.44 - 3133732 (April 14, 2025)

Scripts

ExportIncidentsToCSV

Fixed an issue where the script failed when no results were returned or when the number of results exceeded the defined limit.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

clear-user-session

Changed the clear-user-session command context.
- The structure of the context output has been modified. from {'Message': str, 'Result': str, 'Source': list[str], 'Username': str} to {'Message': str, 'Result': str, 'Brand': str, 'Username': str}.
- Each user and brand will now have their own dictionary instead of one dictionary for each user with a list of sources/brands.
Updated handling the get-user-data command context change.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39397

Download

1.19.42 - 3079234 (April 7, 2025)

Scripts

New: JSONDiff

New: Added a new script- JSONDiff that compares two JSON files and returns their differences, such as added, removed, or changed fields, in a structured format.

ExportAuditLogsToFile

Fixed an issue that caused only 100 records to be retrieved.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

ContentPackInstaller

Updated the Docker image to: demisto/xsoar-tools:1.0.0.2974997.

ProvidesCommand

Updated the Docker image to: demisto/python3:3.12.8.1983910.

GenerateAsBuilt

Updated the Docker image to: demisto/teams:1.0.0.2027266.

GetFieldsByIncidentType

Updated the Docker image to: demisto/python3:3.12.8.1983910.

IncidentFields

Updated the Docker image to: demisto/python3:3.12.8.1983910.

EditServerConfig

Updated the Docker image to: demisto/python3:3.12.8.1983910.

ExportIndicatorsToCSV

Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39489
- 37711
- 39497
- 38761

Download

1.19.39 - 3062885 (April 6, 2025)

Scripts

FormatURL

Updated the FormatURL script to handle numerical IPs in URLs.

Related pull requests:
- 39033

Download

1.19.38 - 3042633 (April 2, 2025)

Scripts

MaliciousRatioReputation

- Documentation and metadata improvements.

VerifyIPv6Indicator

- Documentation and metadata improvements.

cveReputationV2

- Documentation and metadata improvements.

GetEnabledInstances

- Documentation and metadata improvements.

HTTPListRedirects

- Documentation and metadata improvements.

CheckFieldValue

- Documentation and metadata improvements.

JSONtoCSV

- Documentation and metadata improvements.

CloseInvestigationAsDuplicate

- Documentation and metadata improvements.

displayMappedFields

- Documentation and metadata improvements.

DecodeMimeHeader

- Documentation and metadata improvements.

IPToHost

- Documentation and metadata improvements.

PrintToParentIncident

- Documentation and metadata improvements.

PrintRaw

- Documentation and metadata improvements.

AppendindicatorFieldWrapper

- Documentation and metadata improvements.

ZipStrings

- Documentation and metadata improvements.

SetGridField

- Documentation and metadata improvements.

ConvertDatetoUTC

- Documentation and metadata improvements.

ZipFile

- Documentation and metadata improvements.

GetLicenseID

- Documentation and metadata improvements.

cvss_color

- Documentation and metadata improvements.

GeneratePassword

- Documentation and metadata improvements.

FormatURL

- Documentation and metadata improvements.

GenerateSummaryReportButton

- Documentation and metadata improvements.

SetTime

- Documentation and metadata improvements.

GetEntries

- Documentation and metadata improvements.

EncodeToAscii

- Documentation and metadata improvements.

VerifyCIDR

- Documentation and metadata improvements.

ExtractIndicatorsFromWordFile

- Documentation and metadata improvements.

ExportAuditLogsToFile

- Documentation and metadata improvements.

CertificateExtract

- Documentation and metadata improvements.

enrich_exclude_button

- Documentation and metadata improvements.

IncidentFields

- Documentation and metadata improvements.

IPNetwork

- Documentation and metadata improvements.

PrintToIncident

- Documentation and metadata improvements.

ExtractDomainAndFQDNFromUrlAndEmail

- Documentation and metadata improvements.

SearchIncidentsSummary

- Documentation and metadata improvements.

displayUtilitiesResults

- Documentation and metadata improvements.

ExifRead

- Documentation and metadata improvements.

ContentPackInstaller

- Documentation and metadata improvements.

ContextContains

- Documentation and metadata improvements.

GetStringsDistance

- Documentation and metadata improvements.

GetFieldsByIncidentType

- Documentation and metadata improvements.

ServerLogs_docker

- Documentation and metadata improvements.

GetIndicatorDBotScoreFromCache

- Documentation and metadata improvements.

DBotAverageScore

- Documentation and metadata improvements.

UtilAnyResults

- Documentation and metadata improvements.

NumberOfPhishingAttemptPerUser

- Documentation and metadata improvements.

PreProcessImage

- Documentation and metadata improvements.

FeedRelatedIndicatorsWidget

- Documentation and metadata improvements.

LoadJSONFileToContext

- Documentation and metadata improvements.

ExtractIndicatorsFromTextFile

- Documentation and metadata improvements.

GetDataCollectionLink

- Documentation and metadata improvements.

Ping

- Documentation and metadata improvements.

ResolveShortenedURL

- Documentation and metadata improvements.

StringSimilarity

- Documentation and metadata improvements.

ReadFile

- Documentation and metadata improvements.

Base64EncodeV2

- Documentation and metadata improvements.

DockerHardeningCheck

- Documentation and metadata improvements.

get-endpoint-data

- Documentation and metadata improvements.

SetDateField

- Documentation and metadata improvements.

ReadPDFFileV2

- Documentation and metadata improvements.

FileReputation

- Documentation and metadata improvements.

PrintErrorEntry

- Documentation and metadata improvements.

RunPollingCommand

- Documentation and metadata improvements.

GetErrorsFromEntry

- Documentation and metadata improvements.

SearchIncidentsV2

- Documentation and metadata improvements.

ShowIncidentIndicators

- Documentation and metadata improvements.

HTMLtoMD

- Documentation and metadata improvements.

GetDomainDNSDetails

- Documentation and metadata improvements.

IPReputation

- Documentation and metadata improvements.

Strings

- Documentation and metadata improvements.

ParseWordDoc

- Documentation and metadata improvements.

ProvidesCommand

- Documentation and metadata improvements.

ReplaceMatchGroup

- Documentation and metadata improvements.

GetIndicatorDBotScore

- Documentation and metadata improvements.

ParseYAML

- Documentation and metadata improvements.

OnionURLReputation

- Documentation and metadata improvements.

ParseExcel

- Documentation and metadata improvements.

SSDeepReputation

- Documentation and metadata improvements.

DisplayHTMLWithImages

- Documentation and metadata improvements.

DomainReputation

- Documentation and metadata improvements.

LoadJSON

- Documentation and metadata improvements.

SetByIncidentId

- Documentation and metadata improvements.

CalculateEntropy

- Documentation and metadata improvements.

SCPPullFiles

- Documentation and metadata improvements.

AddKeyToList

- Documentation and metadata improvements.

get-user-data

- Documentation and metadata improvements.

ConvertXmlFileToJson

- Documentation and metadata improvements.

PDFUnlocker

- Documentation and metadata improvements.

BreachConfirmationHTML

- Documentation and metadata improvements.

ExtractDomainFromUrlAndEmail

- Documentation and metadata improvements.

IndicatorMaliciousRatioCalculation

- Documentation and metadata improvements.

EditServerConfig

- Documentation and metadata improvements.

URLSSLVerification

- Documentation and metadata improvements.

MITRENameByID_Formatter

- Documentation and metadata improvements.

GenerateRandomString

- Documentation and metadata improvements.

SetMultipleValues

- Documentation and metadata improvements.

CompareLists

- Documentation and metadata improvements.

StixCreator

- Documentation and metadata improvements.

PopulateCriticalAssets

- Documentation and metadata improvements.

TimeStampCompare

- Documentation and metadata improvements.

ExtractAttackPattern

- Documentation and metadata improvements.

ConvertFile

- Documentation and metadata improvements.

SetWithTemplate

- Documentation and metadata improvements.

JSONFileToCSV

- Documentation and metadata improvements.

CommandLineAnalysis

- Documentation and metadata improvements.

ExtractHTMLTables

- Documentation and metadata improvements.

CertificateReputation

- Documentation and metadata improvements.

FileCreateAndUploadV2

- Documentation and metadata improvements.

AssignToMeButton

- Documentation and metadata improvements.

Dig

- Documentation and metadata improvements.

PcapHTTPExtractor

- Documentation and metadata improvements.

JsonUnescape

- Documentation and metadata improvements.

URLReputation

- Documentation and metadata improvements.

VerdictResult

- Documentation and metadata improvements.

ShowLocationOnMap

- Documentation and metadata improvements.

LookupCSV

- Documentation and metadata improvements.

DisplayHTML

- Documentation and metadata improvements.

CheckSenderDomainDistance

- Documentation and metadata improvements.

RunDockerCommand

- Documentation and metadata improvements.

SetIndicatorGridField

- Documentation and metadata improvements.

LanguageDetect

- Documentation and metadata improvements.

EmailReputation

- Documentation and metadata improvements.

clear-user-session

- Documentation and metadata improvements.

AquatoneDiscoverV2

- Documentation and metadata improvements.

ExportIncidentsToCSV

- Documentation and metadata improvements.

IsInternalDomainName

- Documentation and metadata improvements.

URLNumberOfAds

- Documentation and metadata improvements.

FilterByList

- Documentation and metadata improvements.

IsListExist

- Documentation and metadata improvements.

DisableUserWrapper

- Documentation and metadata improvements.

GetByIncidentId

- Documentation and metadata improvements.

StopScheduledTask

- Documentation and metadata improvements.

GenerateRandomUUID

- Documentation and metadata improvements.

BMCTool

- Documentation and metadata improvements.

UnzipFile

- Documentation and metadata improvements.
Fix an issue where the UnzipFile script incorrectly failed when extracting a file containing the word "Errors" in its name.
Updated the Docker image to: demisto/unzip:1.0.0.2038416.

SSDeepSimilarity

- Documentation and metadata improvements.

AddDBotScoreToContext

- Documentation and metadata improvements.

MarkAsEvidenceByTag

- Documentation and metadata improvements.

DumpJSON

- Documentation and metadata improvements.

IsUrlPartOfDomain

- Documentation and metadata improvements.

IsPDFFileEncrypted

- Documentation and metadata improvements.

GetServerURL

- Documentation and metadata improvements.

ConvertCountryCodeCountryName

- Documentation and metadata improvements.

PrettyPrint

- Documentation and metadata improvements.

CopyNotesToIncident

- Documentation and metadata improvements.

DownloadAndArchivePythonLibrary

- Documentation and metadata improvements.

CheckIndicatorValue

- Documentation and metadata improvements.

TextFromHTML

- Documentation and metadata improvements.

CreateIndicatorsFromSTIX

- Documentation and metadata improvements.

ExportContextToJSONFile

- Documentation and metadata improvements.

MatchRegexV2

- Documentation and metadata improvements.

TopMaliciousRatioIndicators

- Documentation and metadata improvements.

LinkIncidentsButton

- Documentation and metadata improvements.

CompareIncidentsLabels

- Documentation and metadata improvements.

CreateHash

- Documentation and metadata improvements.

PrintToAlert

- Documentation and metadata improvements.

IsInternalHostName

- Documentation and metadata improvements.

ReadQRCode

- Documentation and metadata improvements.

ParseCSV

- Documentation and metadata improvements.

ExtractHyperlinksFromOfficeFiles

- Documentation and metadata improvements.

ExportIndicatorsToCSV

- Documentation and metadata improvements.

ConvertTimezoneFromUTC

- Documentation and metadata improvements.

IsolationAssetWrapper

- Documentation and metadata improvements.

FileToBase64List

- Documentation and metadata improvements.

hideFieldsOnNewIncident

- Documentation and metadata improvements.

GenerateAsBuilt

- Documentation and metadata improvements.

RepopulateFiles

- Documentation and metadata improvements.

Base64ListToFile

- Documentation and metadata improvements.

ListUsedDockerImages

- Documentation and metadata improvements.

GetListRow

- Documentation and metadata improvements.

ParseEmailFilesV2

- Documentation and metadata improvements.

ParseHTMLIndicators

- Documentation and metadata improvements.

ServerLogs

- Documentation and metadata improvements.

DeduplicateValuesbyKey

- Documentation and metadata improvements.

CopyContextToField

- Documentation and metadata improvements.

SearchIndicator

- Documentation and metadata improvements.

GetInstances

- Documentation and metadata improvements.

RemoveKeyFromList

- Documentation and metadata improvements.

ScheduleGenericPolling

- Documentation and metadata improvements.

IdentifyAttachedEmail

- Documentation and metadata improvements.

HttpV2

- Documentation and metadata improvements.

FetchIndicatorsFromFile

- Documentation and metadata improvements.

ExtractFQDNFromUrlAndEmail

- Documentation and metadata improvements.

CheckContextValue

- Documentation and metadata improvements.

PrintContext

- Documentation and metadata improvements.

PositiveDetectionsVSDetectionEngines

- Documentation and metadata improvements.

CreateNewIndicatorsOnly

- Documentation and metadata improvements.

GetDockerImageLatestTag

- Documentation and metadata improvements.

MarkAsNoteByTag

- Documentation and metadata improvements.

CalculateTimeDifference

- Documentation and metadata improvements.

CVSSCalculator

- Documentation and metadata improvements.

ExtractEmailV2

- Documentation and metadata improvements.

ArrayToCSV

- Documentation and metadata improvements.

ChangeContext

- Documentation and metadata improvements.

ExportToXLSX

- Documentation and metadata improvements.

GridFieldSetup

- Documentation and metadata improvements.

AnalyzeTimestampIntervals

- Documentation and metadata improvements.

PortListenCheck

- Documentation and metadata improvements.

Related pull requests:
- 39390

Download

1.19.36 - 3014055 (March 30, 2025)

Scripts

GetTime

Documentation and metadata improvements.

Related pull requests:
- 39311

Download

1.19.35 - R3000194 (March 28, 2025)

Scripts

FormatURL

Fixed an issue where a URL encoded as ProofPoint URLDefense v3 was not properly extracted.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39086

Download

1.19.34 - 2929110 (March 20, 2025)

Scripts

IsPDFFileEncrypted

Improved documentation.

Related pull requests:
- 39007

Download

1.19.32 - 2895868 (March 17, 2025)

Scripts

IPNetwork

Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 39066
- 38344
- 39003
- 38344

Download

1.19.31 - 2691641 (March 9, 2025)

Scripts

FormatURL

Updated the FormatURL script to allow URLs with numerical IPs.

Related pull requests:
- 38923

Download

1.19.30 - 2628530 (March 3, 2025)

Scripts

Set

Fixed an issue where integers were set to the context as strings.
Values greater than 9007199254740991 will still be set as strings.

Related pull requests:
- 38818

Download

1.19.29 - 2613464 (March 2, 2025)

Scripts

DeleteContext

Internal code improvements.

Related pull requests:
- 38651

Download

1.19.28 - 2480529 (February 17, 2025)

Scripts

New: IsPDFFileEncrypted

New: Added a new script IsPDFFileEncrypted that checks whether the PDF file is encrypted.

Related pull requests:
- 38649

Download

1.19.27 - 2472843 (February 16, 2025)

Scripts

emailFieldTriggered

Fixed an issue where emails were not being sent due to incorrect owner matching.

Related pull requests:
- 38615

Download

1.19.26 - 2459630 (February 13, 2025)

Scripts

MITRENameByID_Formatter

Improved implementation by restricting the query to certain indicator types.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

Related pull requests:
- 38596
- 38630

Download

1.19.25 - 2438447 (February 11, 2025)

Scripts

ParseEmailFilesV2

Fixed an issue where the ParseEmailFilesV2 script failed parsing a file contains BOM.

StixCreator

Related pull requests:
- 38349

Download

1.19.23 - 2429474 (February 11, 2025)

Scripts

VerifyJSON

Updated the Docker image to: demisto/powershell:7.4.6.117357.

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.2017685.

Related pull requests:
- 38552
- 38543
- 38544
- 38546
- 38547

Download

1.19.22 - 2306914 (February 9, 2025)

Scripts

CloseInvestigationAsDuplicate

Added support for raise_error argument, which allows raising an error in case of unclosed incident.
Updated the Docker image to: demisto/python3:3.12.8.1983910.

CreateNewIndicatorsOnly

Fixed an issue where the value of an existing indicator had a different letter case than the indicator on input.
Fixed an issue where the script tried to associate to the incident an indicator that was not created, as it might have been excluded.
Updated the Docker image to: demisto/python3:3.11.11.1940698.

Related pull requests:
- 38535
- 38429

Download

1.19.20 - 2151668 (February 6, 2025)

Scripts

ParseEmailFilesV2

Fixed an issue where some EML files were incorrectly decoded.
Updated the Docker image to: demisto/parse-emails:1.0.0.2147169.

Related pull requests:
- 38511

Download

1.19.19 - 2148169 (February 5, 2025)

Scripts

EmailAskUserResponse

Fixed an issue where the script failed to run for any value.

Related pull requests:
- 38509

Download

1.19.18 - 2134850 (February 4, 2025)

Scripts

ParseEmailFilesV2

Fixed an issue that prevented the headers from being parsed correctly for eml files (unknown-8bit encoding).
Fixed an issue that email with attachment was parsed incorrectly for eml files.
Updated the Docker image to: demisto/parse-emails:1.0.0.2128577.

Related pull requests:
- 38462

Download

1.19.17 - 2110804 (January 30, 2025)

Scripts

CommandLineAnalysis

Fixed an issue in CommandLineAnalysis where the original command was analyzed as part of the decoded command analysis.
Updated the output format of the extracted indicators.
Added the patterns to detect macOS Applescript suspicious command lines.

Related pull requests:
- 38325

Download

1.19.16 - 2094777 (January 28, 2025)

Scripts

ParseEmailFilesV2

Documentation and metadata improvements. Updated the parse_only_headers argument description for clarity.

Related pull requests:
- 38255

Download

1.19.15 - 2090051 (January 28, 2025)

Scripts

EmailAskUserResponse

Added a new argument suffix to be used to remove a known suffix in the response.

Related pull requests:
- 38351

Download

1.19.14 - 2081957 (January 27, 2025)

Scripts

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.2020302.

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.2034953.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.2034953.

Related pull requests:
- 38318
- 38316

Download

1.19.12 - 2074399 (January 26, 2025)

Scripts

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.2034848.

Related pull requests:
- 38288
- 38283
- 38281
- 38280
- 38279
- 38278
- 38276
- 38275
- 38274
- 38272
- 38271
- 38273
- 38277
- 38282

Download

1.19.11 - R2065467 (January 23, 2025)

Scripts

EmailAskUserResponse

Added a new argument prefix to be used to remove a known prefix in the response.

Related pull requests:
- 38218

Download

1.19.10 - R1989294 (January 14, 2025)

Scripts

GetDomainDNSDetails

Updated the Docker image to: demisto/netutils:1.0.0.118055.

Ping

Updated the Docker image to: demisto/netutils:1.0.0.118055.

HttpV2

Fixed an issue where the timeout_between_retries argument was treated as a string instead of being converted to a number.

Related pull requests:
- 38109

Download

1.19.8 - 1953876 (January 9, 2025)

Scripts

LookupCSV

Updated the Docker image to: demisto/python3:3.11.11.1940698.

CreateHash

Updated the Docker image to: demisto/python3:3.11.11.1940698.

BMCTool

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

CertificateReputation

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

clear-user-session

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

GetDockerImageLatestTag

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

ResolveShortenedURL

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

UnzipFile

Code functionality improvements.
Updated the Docker image to: demisto/unzip:1.0.0.117525.

Related pull requests:
- 38043

Download

1.19.6 - 1950870 (January 8, 2025)

Scripts

ExtractDomainAndFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.117220.

IPToHost

Updated the script to display a clear message when no hostname is found, instead of returning the IP address.
Updated the Docker image to: demisto/python3:3.11.11.1940698.

Related pull requests:
- 38045

Download

1.19.4 - 1946497 (January 8, 2025)

Scripts

SetGridField

Documentation and metadata improvements.

Related pull requests:
- 37991

Download

1.19.3 - 1935630 (January 6, 2025)

Scripts

AddKeyToList

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

CVSSCalculator

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

Dig

Code functionality and documentation improvements.
Updated the Docker image to: demisto/netutils:1.0.0.118055.

ExtractHTMLTables

Code functionality and documentation improvements.

IndicatorMaliciousRatioCalculation

Code functionality and documentation improvements.

ParseYAML

Code functionality and documentation improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

RemoveKeyFromList

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

SSDeepReputation

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

Related pull requests:
- 37472

Download

1.19.2 - 1928124 (January 5, 2025)

Scripts

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.117511.

Related pull requests:
- 37789
- 37773
- 37772
- 37774
- 37771

Download

1.19.1 - 1919018 (January 3, 2025)

Scripts

get-user-data

Added the attributes parameter to the ad-get-user command in this script to retrieve additional user information.

Related pull requests:
- 37908

Download

1.19.0 - 1873754 (December 25, 2024)

Scripts

New: get-endpoint-data

New: This script gathers endpoint data from multiple integrations and returns an endpoint entity with consolidated information to the context.(Available from Cortex XSIAM 2.4).

Related pull requests:
- 37207

Download

1.18.5 - 1841503 (December 19, 2024)

Scripts

SearchIncidentsV2

Documentation and metadata improvements.

CopyNotesToIncident

Fixed an issue where indicators were auto-extracted from the copied notes regardless of the value of the auto_extract argument.
Updated the Docker image to: demisto/python3:3.11.10.116949.

New: CommandLineAnalysis

New: This script evaluates command-line threats by analyzing both original and decoded inputs. It assigns weighted scores to detected patterns, such as AMSI bypass or credential dumping, and applies risk combination bonuses for multiple detections. The total score is normalized to a 0-100 scale, with risk levels categorized as follows:
0-25: Low Risk
26-50: Medium Risk
51-90: High Risk
91-100: Critical Risk
The scoring mechanism provides a comprehensive risk assessment, considering both the severity and frequency of malicious behaviors.

Related pull requests:
- 37611

Download

1.18.2 - 1834150 (December 18, 2024)

Scripts

New: MITRENameByID_Formatter

New: Get a MITRE ATT&CK object name by its ID. The script is using TIMs IOCs to find the correct name. (MITRE ATT&CK IOCs must exist in the Threat Intel data).

IndicatorMaliciousRatioCalculation

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

RunPollingCommand

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

ExtractIndicatorsFromTextFile

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

NumberOfPhishingAttemptPerUser

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

DeleteContext

Documentation and metadata improvements.

CopyContextToField

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

ExtractIndicatorsFromWordFile

Documentation and metadata improvements.

SetAndHandleEmpty

Documentation and metadata improvements.

CompareIncidentsLabels

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

findIncidentsWithIndicator

Documentation and metadata improvements.

DockerHardeningCheck

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

GetDuplicatesMlv2

Documentation and metadata improvements.

SetByIncidentId

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

SearchIncidentsV2

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

FindSimilarIncidents

Documentation and metadata improvements.

Related pull requests:
- 37760

Download

1.17.7 - 1796926 (December 12, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.1791788.

Related pull requests:
- 37653

Download

1.17.6 - 1793696 (December 11, 2024)

Scripts

FormatURL

Fixed an issue where URLs were not parsed correctly when handling nested parenthesis in the URL query.

ExportToXLSX

Updated the Docker image to: demisto/xslxwriter:1.0.0.117330.

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.117469.

ReadQRCode

Updated the Docker image to: demisto/qrcode:1.0.0.117542.

Related pull requests:
- 37639

Download

1.17.4 - 1780397 (December 9, 2024)

Scripts

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

ParseHTMLIndicators

Updated the Docker image to: demisto/bs4-tld:1.0.0.117606.

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.117810.

Related pull requests:
- 37620
- 37619
- 37618
- 37617

Download

1.17.3 - 1775999 (December 9, 2024)

Scripts

StixCreator

Updated the parsing logic for the autonomous system indicator. When the indicator value is a number, it will be converted to a string.

Related pull requests:
- 37563
- 37449

Download

1.17.2 - 1773546 (December 8, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.118060.

Related pull requests:
- 37607

Download

1.17.1 - 1752502 (December 4, 2024)

Scripts

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.117518.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.117518.

Related pull requests:
- 37544
- 37543
- 37541
- 37542

Download

1.17.0 - 1745299 (December 3, 2024)

Scripts

get-user-data

Updated the script to ensure that all data returned from each command is also returned to the context.
Updated the script to include the source of the data in the context for each field.

ExtractIndicatorsFromWordFile

Internal code improvements.

Related pull requests:
- 37431

Download

1.15.99 - 1741355 (December 3, 2024)

Scripts

StixCreator

Fixed an issue where indicators without names were not properly parsed.

Related pull requests:
- 36027

Download

1.15.98 - 1738579 (December 2, 2024)

Scripts

ExportToCSV

Improved consistency of the script output by removing carriage return (\r) characters from the end of lines.

SetGridField

Updated the Docker image to: demisto/pandas:1.0.0.117209.

GenerateAsBuilt

Updated the Docker image to: demisto/teams:1.0.0.116912.

Related pull requests:
- 37425
- 37421
- 37419
- 37422
- 37418
- 37420

Download

1.15.96 - 1731907 (December 1, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.117740.

New: clear-user-session

Added the clear-user-session script to clear user sessions from multiple integrations.

Related pull requests:
- 37255

Download

1.15.94 - 1709192 (November 26, 2024)

Scripts

CertificateExtract

Updated the Docker image to: demisto/crypto:1.0.0.114611.

Related pull requests:
- 37353
- 37421
- 37418
- 37375
- 37425
- 37419
- 37420
- 37422

Download

1.15.93 - 1699115 (November 25, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

ExtractHTMLTables

Updated the Docker image to: demisto/bs4-py3:1.0.0.117152.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.117112.

Related pull requests:
- 37378
- 37355
- 37356
- 37357

Download

1.15.92 - 1696672 (November 24, 2024)

Scripts

ReadPDFFileV2

Fixed an issue where the script failed to handle binary data in PDF annotation objects.

Related pull requests:
- 37408

Download

1.15.91 - 1675652 (November 20, 2024)

Scripts

VerifyJSON

Updated the Docker image to: demisto/powershell:7.4.6.116823.

Related pull requests:
- 37287
- 37283

Download

1.15.90 - 1666862 (November 18, 2024)

Scripts

VerifyJSON

Updated the Docker image to: demisto/powershell:7.4.2.103657.

Related pull requests:
- 37214
- 37193

Download

1.15.89 - 1663384 (November 18, 2024)

Scripts

ConvertXmlFileToJson

Updated the Docker image to: demisto/xml-feed:1.0.0.116765.

Related pull requests:
- 37225
- 37222

Download

1.15.88 - 1647729 (November 14, 2024)

Scripts

DeduplicateValuesbyKey

Updated the Docker image to: demisto/python3:3.11.10.115186.

TimeStampCompare

Updated the Docker image to: demisto/python3:3.11.10.115186.

URLNumberOfAds

Updated the Docker image to: demisto/python3:3.11.10.115186.

DisplayHTML

Updated the Docker image to: demisto/python3:3.11.10.115186.

VerdictResult

Updated the Docker image to: demisto/python3:3.11.10.115186.

IsListExist

Updated the Docker image to: demisto/python3:3.11.10.115186.

LookupCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetIndicatorDBotScore

Updated the Docker image to: demisto/python3:3.11.10.115186.

ZipStrings

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreateIndicatorsFromSTIX

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetLicenseID

Updated the Docker image to: demisto/python3:3.11.10.115186.

hideFieldsOnNewIncident

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExportIncidentsToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

ResolveShortenedURL

Updated the Docker image to: demisto/python3:3.11.10.115186.

SearchIndicator

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractIndicatorsFromTextFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

Base64EncodeV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

VerifyIPv6Indicator

Updated the Docker image to: demisto/python3:3.11.10.115186.

ReadFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintErrorEntry

Updated the Docker image to: demisto/python3:3.11.10.115186.

SCPPullFiles

Updated the Docker image to: demisto/python3:3.11.10.115186.

DecodeMimeHeader

Updated the Docker image to: demisto/python3:3.11.10.115186.

HTTPListRedirects

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetMultipleValues

Updated the Docker image to: demisto/python3:3.11.10.115186.

ConvertCountryCodeCountryName

Updated the Docker image to: demisto/python3:3.11.10.115186.

ParseCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

SearchIncidentsSummary

Updated the Docker image to: demisto/python3:3.11.10.115186.

CertificateReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

BMCTool

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckIndicatorValue

Updated the Docker image to: demisto/python3:3.11.10.115186.

AddKeyToList

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetInstances

Updated the Docker image to: demisto/python3:3.11.10.115186.

IdentifyAttachedEmail

Updated the Docker image to: demisto/python3:3.11.10.115186.

JSONtoCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreateHash

Updated the Docker image to: demisto/python3:3.11.10.115186.

DumpJSON

Updated the Docker image to: demisto/python3:3.11.10.115186.

ServerLogs_docker

Updated the Docker image to: demisto/python3:3.11.10.115186.

ScheduleGenericPolling

Updated the Docker image to: demisto/python3:3.11.10.115186.

ConvertTimezoneFromUTC

Updated the Docker image to: demisto/python3:3.11.10.115186.

GridFieldSetup

Updated the Docker image to: demisto/python3:3.11.10.115186.

TextFromHTML

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetIndicatorGridField

Updated the Docker image to: demisto/python3:3.11.10.115186.

enrich_exclude_button

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrettyPrint

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckSenderDomainDistance

Updated the Docker image to: demisto/python3:3.11.10.115186.

Base64ListToFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

DomainReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

CopyNotesToIncident

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetWithTemplate

Updated the Docker image to: demisto/python3:3.11.10.115186.

UtilAnyResults

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChangeContext

Updated the Docker image to: demisto/python3:3.11.10.115186.

cveReputationV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

MaliciousRatioReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractEmailV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

FeedRelatedIndicatorsWidget

Updated the Docker image to: demisto/python3:3.11.10.115186.

ArrayToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

DisplayHTMLWithImages

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintToAlert

Updated the Docker image to: demisto/python3:3.11.10.115186.

ParseYAML

Updated the Docker image to: demisto/python3:3.11.10.115186.

IsolationAssetWrapper

Updated the Docker image to: demisto/python3:3.11.10.115186.

GeneratePassword

Updated the Docker image to: demisto/python3:3.11.10.115186.

DisableUserWrapper

Updated the Docker image to: demisto/python3:3.11.10.115186.

StringSimilarity

Updated the Docker image to: demisto/python3:3.11.10.115186.

PortListenCheck

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintContext

Updated the Docker image to: demisto/python3:3.11.10.115186.

ShowIncidentIndicators

Updated the Docker image to: demisto/python3:3.11.10.115186.

JSONFileToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckContextValue

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetStringsDistance

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetServerURL

Updated the Docker image to: demisto/python3:3.11.10.115186.

IPReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

OnionURLReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

URLSSLVerification

Updated the Docker image to: demisto/python3:3.11.10.115186.

AppendindicatorFieldWrapper

Updated the Docker image to: demisto/python3:3.11.10.115186.

StopScheduledTask

Updated the Docker image to: demisto/python3:3.11.10.115186.

URLReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

ServerLogs

Updated the Docker image to: demisto/python3:3.11.10.115186.

get-user-data

Updated the Docker image to: demisto/python3:3.11.10.115186.

PositiveDetectionsVSDetectionEngines

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExportAuditLogsToFile

Updated the Docker image to: demisto/python3:3.11.10.115186.

RunPollingCommand

Updated the Docker image to: demisto/python3:3.11.10.115186.

RunDockerCommand

Updated the Docker image to: demisto/python3:3.11.10.115186.

DBotAverageScore

Updated the Docker image to: demisto/python3:3.11.10.115186.

FilterByList

Updated the Docker image to: demisto/python3:3.11.10.115186.

RemoveKeyFromList

Updated the Docker image to: demisto/python3:3.11.10.115186.

CalculateEntropy

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractAttackPattern

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetEnabledInstances

Updated the Docker image to: demisto/python3:3.11.10.115186.

SearchIncidentsV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

EmailReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

FileCreateAndUploadV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintRaw

Updated the Docker image to: demisto/python3:3.11.10.115186.

IsUrlPartOfDomain

Updated the Docker image to: demisto/python3:3.11.10.115186.

ProvidesCommand

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetFieldsByIncidentType

Updated the Docker image to: demisto/python3:3.11.10.115186.

ReplaceMatchGroup

Updated the Docker image to: demisto/python3:3.11.10.115186.

VerifyCIDR

Updated the Docker image to: demisto/python3:3.11.10.115186.

MatchRegexV2

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.115186.

cvss_color

Updated the Docker image to: demisto/python3:3.11.10.115186.

Strings

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetListRow

Updated the Docker image to: demisto/python3:3.11.10.115186.

IncidentFields

Updated the Docker image to: demisto/python3:3.11.10.115186.

ShowLocationOnMap

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetIndicatorDBotScoreFromCache

Updated the Docker image to: demisto/python3:3.11.10.115186.

FileReputation

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetEntries

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckFieldValue

Updated the Docker image to: demisto/python3:3.11.10.115186.

RepopulateFiles

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetDockerImageLatestTag

Updated the Docker image to: demisto/python3:3.11.10.115186.

AnalyzeTimestampIntervals

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintToParentIncident

Updated the Docker image to: demisto/python3:3.11.10.115186.

LoadJSON

Updated the Docker image to: demisto/python3:3.11.10.115186.

TopMaliciousRatioIndicators

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExportIndicatorsToCSV

Updated the Docker image to: demisto/python3:3.11.10.115186.

BreachConfirmationHTML

Updated the Docker image to: demisto/python3:3.11.10.115186.

ListUsedDockerImages

Updated the Docker image to: demisto/python3:3.11.10.115186.

PrintToIncident

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetDataCollectionLink

Updated the Docker image to: demisto/python3:3.11.10.115186.

SetTime

Updated the Docker image to: demisto/python3:3.11.10.115186.

GetErrorsFromEntry

Updated the Docker image to: demisto/python3:3.11.10.115186.

FormatURL

Updated the Docker image to: demisto/python3:3.11.10.115186.

CreateNewIndicatorsOnly

Updated the Docker image to: demisto/python3:3.11.10.115186.

FileToBase64List

Updated the Docker image to: demisto/python3:3.11.10.115186.

MarkAsNoteByTag

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37147
- 37137
- 37136
- 37140
- 37138
- 37139

Download

1.15.87 - 1631266 (November 12, 2024)

Scripts

displayMappedFields

Fixed an misalignment issue when field values contains "|" character.
Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37176

Download

1.15.86 - 1627458 (November 12, 2024)

Scripts

SetMultipleValues

Updated the Docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 35282

Download

1.15.85 - 1621428 (November 11, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where email addresses with commas in the display name were not parsed correctly.
Updated the Docker image to: demisto/parse-emails:1.0.0.115640.

Related pull requests:
- 37153

Download

1.15.83 - 1615839 (November 10, 2024)

Scripts

Ping

Updated the Docker image to: demisto/netutils:1.0.0.115452.

Dig

Updated the Docker image to: demisto/netutils:1.0.0.115452.

GetDomainDNSDetails

Updated the Docker image to: demisto/netutils:1.0.0.115452.

HTMLtoMD

Updated the Docker image to: demisto/btfl-soup:1.0.1.115405.

ContentPackInstaller

Updated the Docker image to: demisto/xsoar-tools:1.0.0.115559.

Related pull requests:
- 37124
- 37115
- 37122
- 37108
- 37111
- 37109

Download

1.15.81 - 1605511 (November 7, 2024)

Scripts

PreProcessImage

Updated the Docker image to: demisto/processing-image-file:1.0.0.115372.

Related pull requests:
- 37103
- 37093

Download

1.15.80 - 1602991 (November 6, 2024)

Scripts

ParseExcel

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

DownloadAndArchivePythonLibrary

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

FetchIndicatorsFromFile

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExtractFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ZipFile

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

StixCreator

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExifRead

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExtractDomainFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

LanguageDetect

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

ExtractDomainAndFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.114656.

cvss_color

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckSenderDomainDistance

Updated the Docker image to: demisto/python3:3.11.10.113941.

DisplayHTMLWithImages

Updated the Docker image to: demisto/python3:3.11.10.113941.

Base64EncodeV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

ResolveShortenedURL

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.113941.

CloseInvestigationAsDuplicate

Updated the Docker image to: demisto/python3:3.11.10.113941.

Strings

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckIndicatorValue

Updated the Docker image to: demisto/python3:3.11.10.113941.

DisableUserWrapper

Updated the Docker image to: demisto/python3:3.11.10.113941.

ChangeContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetDockerImageLatestTag

Updated the Docker image to: demisto/python3:3.11.10.113941.

AnalyzeTimestampIntervals

Updated the Docker image to: demisto/python3:3.11.10.113941.

IPToHost

Updated the Docker image to: demisto/python3:3.11.10.113941.

ShowLocationOnMap

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExportIndicatorsToCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetDataCollectionLink

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExtractAttackPattern

Updated the Docker image to: demisto/python3:3.11.10.113941.

GenerateRandomString

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExportContextToJSONFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

ReadFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

ScheduleGenericPolling

Updated the Docker image to: demisto/python3:3.11.10.113941.

ContextContains

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreateHash

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsolationAssetWrapper

Updated the Docker image to: demisto/python3:3.11.10.113941.

SearchIncidentsV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

GeneratePassword

Updated the Docker image to: demisto/python3:3.11.10.113941.

HTTPListRedirects

Updated the Docker image to: demisto/python3:3.11.10.113941.

LoadJSONFileToContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreateNewIndicatorsOnly

Updated the Docker image to: demisto/python3:3.11.10.113941.

AddDBotScoreToContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetMultipleValues

Updated the Docker image to: demisto/python3:3.11.10.113941.

FeedRelatedIndicatorsWidget

Updated the Docker image to: demisto/python3:3.11.10.113941.

GenerateRandomUUID

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetTime

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrettyPrint

Updated the Docker image to: demisto/python3:3.11.10.113941.

cveReputationV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

VerifyCIDR

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsListExist

Updated the Docker image to: demisto/python3:3.11.10.113941.

get-user-data

Updated the Docker image to: demisto/python3:3.11.10.113941.

LookupCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

DomainReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

SCPPullFiles

Updated the Docker image to: demisto/python3:3.11.10.113941.

ParseCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

AppendindicatorFieldWrapper

Updated the Docker image to: demisto/python3:3.11.10.113941.

CVSSCalculator

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetEntries

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExportAuditLogsToFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

MaliciousRatioReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintToIncident

Updated the Docker image to: demisto/python3:3.11.10.113941.

ZipStrings

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckContextValue

Updated the Docker image to: demisto/python3:3.11.10.113941.

displayUtilitiesResults

Updated the Docker image to: demisto/python3:3.11.10.113941.

RepopulateFiles

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckFieldValue

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsUrlPartOfDomain

Updated the Docker image to: demisto/python3:3.11.10.113941.

ConvertCountryCodeCountryName

Updated the Docker image to: demisto/python3:3.11.10.113941.

GenerateSummaryReportButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

ConvertDatetoUTC

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetEnabledInstances

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetServerURL

Updated the Docker image to: demisto/python3:3.11.10.113941.

DumpJSON

Updated the Docker image to: demisto/python3:3.11.10.113941.

TimeStampCompare

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetByIncidentId

Updated the Docker image to: demisto/python3:3.11.10.113941.

CompareLists

Updated the Docker image to: demisto/python3:3.11.10.113941.

ConvertTimezoneFromUTC

Updated the Docker image to: demisto/python3:3.11.10.113941.

TextFromHTML

Updated the Docker image to: demisto/python3:3.11.10.113941.

ServerLogs_docker

Updated the Docker image to: demisto/python3:3.11.10.113941.

CalculateEntropy

Updated the Docker image to: demisto/python3:3.11.10.113941.

DockerHardeningCheck

Updated the Docker image to: demisto/python3:3.11.10.113941.

ListUsedDockerImages

Updated the Docker image to: demisto/python3:3.11.10.113941.

IncidentFields

Updated the Docker image to: demisto/python3:3.11.10.113941.

FilterByList

Updated the Docker image to: demisto/python3:3.11.10.113941.

FileReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

URLSSLVerification

Updated the Docker image to: demisto/python3:3.11.10.113941.

NumberOfPhishingAttemptPerUser

Updated the Docker image to: demisto/python3:3.11.10.113941.

PortListenCheck

Updated the Docker image to: demisto/python3:3.11.10.113941.

URLReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsInternalHostName

Updated the Docker image to: demisto/python3:3.11.10.113941.

URLNumberOfAds

Updated the Docker image to: demisto/python3:3.11.10.113941.

JSONtoCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintToAlert

Updated the Docker image to: demisto/python3:3.11.10.113941.

IPReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintContext

Updated the Docker image to: demisto/python3:3.11.10.113941.

ReplaceMatchGroup

Updated the Docker image to: demisto/python3:3.11.10.113941.

TopMaliciousRatioIndicators

Updated the Docker image to: demisto/python3:3.11.10.113941.

UtilAnyResults

Updated the Docker image to: demisto/python3:3.11.10.113941.

ServerLogs

Updated the Docker image to: demisto/python3:3.11.10.113941.

OnionURLReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

enrich_exclude_button

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetFieldsByIncidentType

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetDateField

Updated the Docker image to: demisto/python3:3.11.10.113941.

AssignToMeButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

AddKeyToList

Updated the Docker image to: demisto/python3:3.11.10.113941.

PopulateCriticalAssets

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExtractEmailV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

SearchIncidentsSummary

Updated the Docker image to: demisto/python3:3.11.10.113941.

FileToBase64List

Updated the Docker image to: demisto/python3:3.11.10.113941.

IsInternalDomainName

Updated the Docker image to: demisto/python3:3.11.10.113941.

FileCreateAndUploadV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

RemoveKeyFromList

Updated the Docker image to: demisto/python3:3.11.10.113941.

DecodeMimeHeader

Updated the Docker image to: demisto/python3:3.11.10.113941.

DeduplicateValuesbyKey

Updated the Docker image to: demisto/python3:3.11.10.113941.

ExtractIndicatorsFromTextFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

LoadJSON

Updated the Docker image to: demisto/python3:3.11.10.113941.

BreachConfirmationHTML

Updated the Docker image to: demisto/python3:3.11.10.113941.

DBotAverageScore

Updated the Docker image to: demisto/python3:3.11.10.113941.

CalculateTimeDifference

Updated the Docker image to: demisto/python3:3.11.10.113941.

SSDeepReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

MarkAsNoteByTag

Updated the Docker image to: demisto/python3:3.11.10.113941.

ShowIncidentIndicators

Updated the Docker image to: demisto/python3:3.11.10.113941.

displayMappedFields

Updated the Docker image to: demisto/python3:3.11.10.113941.

MarkAsEvidenceByTag

Updated the Docker image to: demisto/python3:3.11.10.113941.

EncodeToAscii

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintRaw

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetStringsDistance

Updated the Docker image to: demisto/python3:3.11.10.113941.

HttpV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetIndicatorGridField

Updated the Docker image to: demisto/python3:3.11.10.113941.

IndicatorMaliciousRatioCalculation

Updated the Docker image to: demisto/python3:3.11.10.113941.

EmailReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintErrorEntry

Updated the Docker image to: demisto/python3:3.11.10.113941.

GridFieldSetup

Updated the Docker image to: demisto/python3:3.11.10.113941.

JSONFileToCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetIndicatorDBotScore

Updated the Docker image to: demisto/python3:3.11.10.113941.

CopyNotesToIncident

Updated the Docker image to: demisto/python3:3.11.10.113941.

MatchRegexV2

Updated the Docker image to: demisto/python3:3.11.10.113941.

IdentifyAttachedEmail

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetInstances

Updated the Docker image to: demisto/python3:3.11.10.113941.

PrintToParentIncident

Updated the Docker image to: demisto/python3:3.11.10.113941.

ArrayToCSV

Updated the Docker image to: demisto/python3:3.11.10.113941.

EditServerConfig

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetErrorsFromEntry

Updated the Docker image to: demisto/python3:3.11.10.113941.

CopyContextToField

Updated the Docker image to: demisto/python3:3.11.10.113941.

DisplayHTML

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetLicenseID

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetIndicatorDBotScoreFromCache

Updated the Docker image to: demisto/python3:3.11.10.113941.

StringSimilarity

Updated the Docker image to: demisto/python3:3.11.10.113941.

ParseYAML

Updated the Docker image to: demisto/python3:3.11.10.113941.

VerifyIPv6Indicator

Updated the Docker image to: demisto/python3:3.11.10.113941.

StopScheduledTask

Updated the Docker image to: demisto/python3:3.11.10.113941.

RunDockerCommand

Updated the Docker image to: demisto/python3:3.11.10.113941.

RunPollingCommand

Updated the Docker image to: demisto/python3:3.11.10.113941.

BMCTool

Updated the Docker image to: demisto/python3:3.11.10.113941.

VerdictResult

Updated the Docker image to: demisto/python3:3.11.10.113941.

hideFieldsOnNewIncident

Updated the Docker image to: demisto/python3:3.11.10.113941.

CompareIncidentsLabels

Updated the Docker image to: demisto/python3:3.11.10.113941.

PositiveDetectionsVSDetectionEngines

Updated the Docker image to: demisto/python3:3.11.10.113941.

SetWithTemplate

Updated the Docker image to: demisto/python3:3.11.10.113941.

Base64ListToFile

Updated the Docker image to: demisto/python3:3.11.10.113941.

SearchIndicator

Updated the Docker image to: demisto/python3:3.11.10.113941.

CreateIndicatorsFromSTIX

Updated the Docker image to: demisto/python3:3.11.10.113941.

FormatURL

Updated the Docker image to: demisto/python3:3.11.10.113941.

LinkIncidentsButton

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetListRow

Updated the Docker image to: demisto/python3:3.11.10.113941.

CertificateReputation

Updated the Docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 36997
- 36994
- 37006
- 36993
- 36998
- 37059
- 37052
- 36995
- 37051
- 36992

Download

1.15.79 - 1597102 (November 5, 2024)

Scripts

JsonUnescape

Updated the Docker image to: demisto/python3-deb:3.11.10.114849.

Related pull requests:
- 37046
- 37042
- 37041

Download

1.15.78 - 1592987 (November 5, 2024)

Scripts

SearchIncidentsV2

Documentation and metadata improvements.

Related pull requests:
- 37048

Download

1.15.77 - 1574765 (October 31, 2024)

Scripts

FailedInstances

Fixed an issue where the script was ignoring instances in an error state.

Related pull requests:
- 37004

Download

1.15.76 - 1563308 (October 29, 2024)

Scripts

SSDeepSimilarity

Updated the Docker image to: demisto/ssdeep:1.0.0.114703.

Related pull requests:
- 36856
- 36845
- 36844
- 36843
- 36840
- 36837
- 36836
- 36832
- 36842
- 36841
- 36839
- 36838
- 36834
- 36835
- 36833

Download

1.15.75 - 1537605 (October 22, 2024)

Scripts

PreProcessImage

Updated the Docker image to: demisto/processing-image-file:1.0.0.113909.

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.113908.

Related pull requests:
- 36780
- 36769
- 36784
- 36766
- 36771
- 36498
- 36747
- 36773
- 36759
- 36725
- 36774
- 35865

Download

1.15.74 - 1533081 (October 21, 2024)

Scripts

SearchIncidentsV2

Added the includeinformational argument.
Updated the Docker image to: demisto/python3:3.11.10.111526.

Related pull requests:
- 35865

Download

1.15.73 - 1504524 (October 14, 2024)

Scripts

SSDeepSimilarity

Updated the Docker image to: demisto/ssdeep:1.0.0.112284.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.112283.

JsonUnescape

Updated the Docker image to: demisto/python3-deb:3.11.10.112166.

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.112283.

UnzipFile

Updated the Docker image to: demisto/unzip:1.0.0.112289.

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.112272.

ReadQRCode

Updated the Docker image to: demisto/qrcode:1.0.0.112357.

Related pull requests:
- 36505
- 36495
- 36494
- 36493
- 36492
- 36491
- 36490
- 36489
- 36486
- 36485
- 36484
- 36483
- 36488
- 36487

Download

1.15.72 - 1491068 (October 10, 2024)

Scripts

SearchIncidentsV2

Fixed an issue (typo)

Related pull requests:
- 36667
- 36664

Download

1.15.71 - 1487718 (October 9, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where attachment file name encoded in windows-874 could not be parsed correctly.
Updated the Docker image to: demisto/parse-emails:1.0.0.113216.

Related pull requests:
- 36629

Download

1.15.70 - 1480610 (October 8, 2024)

Scripts

New: get-user-data

New: This script gathers user data from multiple integrations and returns an Account entity with consolidated information to the context.##### ShowIncidentIndicators

Fixed an issue with ShowIncidentIndicators fetching indicators with the same IDs.
Updated the Docker image to: demisto/python3:3.11.10.111526.

Related pull requests:
- 36260
- 36657

Download

1.15.68 - 1477969 (October 8, 2024)

Scripts

SearchIncidentsV2

Fixed an issue when asking for a summarized version of found incidents would not show properly in XSIAM.

Related pull requests:
- 36650
- 36631

Download

1.15.67 - 1475337 (October 7, 2024)

Scripts

IdentifyAttachedEmail

Fixed an issue where files of type 'message/rfc822' were not identified as emails.

Related pull requests:
- 36620

Download

1.15.66 - 1470320 (October 6, 2024)

Scripts

DeleteContext

Fixed an issue where DBotScore key was not excluded from deletion.

Related pull requests:
- 36594

Download

1.15.65 - 1457639 (October 1, 2024)

Scripts

StixCreator

Enhanced TAXII2FeedApiModule to support setting indicator enrichment exclusion in select feeds. The change has no impact on this script.

Related pull requests:
- 36445

Download

1.15.64 - 1434344 (September 25, 2024)

Scripts

ExtractDomainAndFQDNFromUrlAndEmail

Updated the formatter to avoid ".onion" domains.

New: AnalyzeTimestampIntervals

New: This script analyzes Unix timestamps to detect patterns of automation, focusing on consistent intervals and high frequency.

Related pull requests:
- 36082

Download

1.15.62 - 1419889 (September 23, 2024)

Incident Fields

Breach Confirmation
Added support for IBM QRadar SOAR Incident in the Breach Confirmation field.

Related pull requests:
- 35286

Download

1.15.61 - 1378119 (September 12, 2024)

Scripts

DeleteContext

Fixed an issue where in some cases the script ignored the keysToKeep argument.

Related pull requests:
- 36292

Download

1.15.60 - 1368468 (September 10, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Fixed an issue where the script failed to detect files with uppercase or mixed-case extensions (e.g., .Xlsx).

Related pull requests:
- 36193

Download

1.15.59 - 1358619 (September 8, 2024)

Scripts

StixCreator

Fixed an issue where the fetch-indicators command failed to parse nested reports indicators correctly in the Unit42v2 Feed.

enrich_exclude_button

Updated the script description.

Related pull requests:
- 36024

Download

1.15.57 - 1350055 (September 5, 2024)

Scripts

GetEntries

Added the following arguments:
- page_size
- last_id
- first_id
- selected_entry_id
- users
- tags_and_operator
- from_time
- parent_id
Updated the Docker image to: demisto/python3:3.11.9.109226.

Related pull requests:
- 36114
- 36150

Download

1.15.56 - R1340401 (September 3, 2024)

Scripts

ExtractFQDNFromUrlAndEmail

Documentation and metadata improvements.
Updated the Docker image to: demisto/py3-tools:1.0.0.108682.

ExtractDomainAndFQDNFromUrlAndEmail

Documentation and metadata improvements.
Updated the Docker image to: demisto/py3-tools:1.0.0.108682.

Related pull requests:
- 36053

Download

1.15.55 - R1317860 (August 28, 2024)

Scripts

ScheduleGenericPolling

Fixed an issue where the script would fail in case one of the arguments: additionalPollingCommandArgNames or additionalPollingCommandArgValues was not given.

Related pull requests:
- 36036

Download

1.15.54 - 1311942 (August 26, 2024)

Scripts

ScheduleGenericPolling

Fixed an issue where the script failed when given values containing quotation marks.
Updated the Docker image to: demisto/python3:3.11.9.107902.

GenericPollingScheduledTask

Fixed an issue where the script failed when given values containing quotation marks.

Related pull requests:
- 35995

Download

1.15.53 - 1284734 (August 18, 2024)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 35705

Download

1.15.52 - 1277948 (August 15, 2024)

Scripts

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.108439.

Related pull requests:
- 35899

Download

1.15.51 - 1275748 (August 15, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where UTF-8 encoded EML files with 8-bit Content-Transfer-Encoding headers could not be parsed correctly.
Updated the Docker image to: demisto/parse-emails:1.0.0.108364.

Related pull requests:
- 35853

Download

1.15.50 - 1265696 (August 12, 2024)

Scripts

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

ExtractHyperlinksFromOfficeFiles

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

ConvertFile

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.107687.

Related pull requests:
- 35403

Download

1.15.49 - 1262174 (August 11, 2024)

Scripts

FileToBase64List

Improved implementation to prevent the script from running in a new docker container for each call.
Updated the Docker image to: demisto/python3:3.11.9.107902.

Related pull requests:
- 35481

Download

1.15.48 - 1259921 (August 11, 2024)

Scripts

FindSimilarIncidents

Maintenance and stability enhancements.

Related pull requests:
- 35643

Download

1.15.47 - 1257268 (August 9, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where parsing p7m files fails to remove signature.
Updated the Docker image to: demisto/parse-emails:1.0.0.107885.

Related pull requests:
- 35796

Download

1.15.46 - 1256255 (August 8, 2024)

Scripts

DockerHardeningCheck

Internal code improvements.
Updated the Docker image to: demisto/python3:3.11.9.107421.

Related pull requests:
- 35801

Download

1.15.45 - 1252429 (August 7, 2024)

Scripts

IsIntegrationAvailable

Fixed an issue where the script would return an error when the raw-response argument was provided.

Related pull requests:
- 35787

Download

1.15.44 - 1244506 (August 5, 2024)

Scripts

DeleteContext

Performance improvements.

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.106927.

Related pull requests:
- 35732

Download

1.15.42 - 1242168 (August 5, 2024)

Scripts

ContentPackInstaller

Added clearer error messages for cases the script fails.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.104430.

Related pull requests:
- 35622

Download

1.15.41 - 1238470 (August 4, 2024)

Scripts

DisplayHTMLWithImages

Fixed an issue where in XSOAR 8, embedded images did not display in the Email Body section in the Phishing layout.
Updated the Docker image to: demisto/python3:3.11.9.105369.

Related pull requests:
- 35702

Download

1.15.40 - 1230534 (July 31, 2024)

Scripts

FailedInstances

Fixed an issue where the script failed when a ServiceNow CMDB instance was configured with OAuth flow enabled.

Related pull requests:
- 35694

Download

1.15.39 - 1226445 (July 30, 2024)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 35570

Download

1.15.38 - 1218660 (July 28, 2024)

Scripts

IdentifyAttachedEmail

Fixed an issue in which email attachments were not identified in Cortex XSOAR 8.
Fixed an issue in which only one entry ID was added to the context.
Updated the docker image to demisto/python3:3.11.9.104657.

Related pull requests:
- 35569

Download

1.15.37 - 1208894 (July 24, 2024)

Scripts

DisplayHTMLWithImages

Fixed an issue where some embedded images not appear in the Email Body section in the Phishing incident layout.
Updated the Docker image to: demisto/python3:3.11.9.104657.

Related pull requests:
- 35566

Download

1.15.36 - 1206393 (July 24, 2024)

Scripts

New: SetIndicatorGridField

New script to allow you to easily set an indicator grid field.

Related pull requests:
- 35553

Download

1.15.35 - 1204731 (July 23, 2024)

Scripts

ParseEmailFilesV2

Updated the Docker image to: demisto/parse-emails:1.0.0.104899.

Related pull requests:
- 35567

Download

1.15.34 - 1200812 (July 22, 2024)

Scripts

WordTokenizer

Fixed an issue where FindSimilarAlerts automation didn't work properly in XSIAM.

Related pull requests:
- 35547

Download

1.15.33 - 1198326 (July 22, 2024)

Scripts

WordTokenizer

Deprecated. Use DBotPreProcessTextData instead.

Related pull requests:
- 35511

Download

1.15.32 - 1191003 (July 18, 2024)

Scripts

New: PrintToIncident

Prints a value to the specified incident's war-room.

Related pull requests:
- 35468

Download

1.15.31 - 1179382 (July 15, 2024)

Scripts

LookupCSV

Fixed an issue where the script results were added to LookupCSV.result instead of LookupCSV.Result in the context.
Updated the Docker image to: demisto/python3:3.11.9.103066.

Related pull requests:
- 35418

Download

1.15.30 - 1177096 (July 15, 2024)

Scripts

ExportToCSV

Updated the script to handle the issue of encoding non english characters while loading the CSV file in the Microsoft excel sheet. Added a new argument 'codec' to choose between UTF-8 and UTF-16-BOM.

Related pull requests:
- 35407
- 35297

Download

1.15.29 - 1175817 (July 14, 2024)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 35178
- 35115

Download

1.15.27 - 1173616 (July 14, 2024)

Scripts

DisplayHTMLWithImages

Fixed an issue where there was no default text color, and now the default is black.
Updated the Docker image to: demisto/python3:3.11.9.103066.

Related pull requests:
- 35367

Download

1.15.26 - 1169083 (July 11, 2024)

Scripts

VerifyIPv6Indicator

Updated the IPv6 formatter to remove unneeded prefixed characters.
Updated the Docker image to: demisto/python3:3.10.14.101217.

DisplayHTMLWithImages

Fixed an issue where embedded images not appear in the Email Body section in the Phishing incident layout.
Updated the Docker image to: demisto/python3:3.10.14.99474.

Related pull requests:
- 35135

Download

1.15.24 - 1164474 (July 10, 2024)

Scripts

SetGridField

Updated the Docker image to: demisto/pandas:1.0.0.102566.

Related pull requests:
- 35339

Download

1.15.23 - 1159246 (July 8, 2024)

Scripts

ExportAuditLogsToFile

Fixed an issue with Cortex XSOAR 6.x where the command would fail by sending the wrong request.
Updated the Docker image to: demisto/python3:3.10.14.101217.

Related pull requests:
- 35280

Download

1.15.22 - 1156543 (July 8, 2024)

Scripts

ParseCSV

Fixed an issue where passing no escapechar would result in failure.
Updated the Docker image to: demisto/python3:3.10.14.99865.

Related pull requests:
- 33951

Download

1.15.21 - 1150618 (July 5, 2024)

Scripts

New: DownloadAndArchivePythonLibrary

New: The script downloads a Python library using PIP, archives it, and returns the file to the war room.

Related pull requests:
- 33742

Download

1.15.20 - 1149551 (July 4, 2024)

Scripts

ContentPackInstaller

Updated the Docker image to: demisto/xsoar-tools:1.0.0.99061.

Related pull requests:
- 35232

Download

1.15.19 - 1142826 (July 2, 2024)

Scripts

ExtractIndicatorsFromTextFile

Fixed an issue where the outputs were not displayed in the context data.
Updated the Docker image to: demisto/python3:3.10.14.99865.

Related pull requests:
- 35179

Download

1.15.18 - 1135833 (June 30, 2024)

Scripts

ReadQRCode

Fixed an issue where indicators were not extracted from the output.

Related pull requests:
- 35110

Download

1.15.17 - 1126229 (June 26, 2024)

Scripts

ReadQRCode

Improved implementation of stderr redirection by removing wurlitzer.pipes() and redirecting stderr to a temporary file.
The automation now extracts QR codes exclusively to improve performance.
Updated the Docker image to: demisto/qrcode:1.0.0.98232.

Related pull requests:
- 34579

Download

1.15.16 - 1118790 (June 24, 2024)

Scripts

GridFieldSetup

Updated the script to include 10 additional inputs.

Related pull requests:
- 35016
- 35046

Download

1.15.15 - 1110626 (June 21, 2024)

Scripts

DisplayHTMLWithImages

Resolved a situation where there was no default background, and now the default background is white.
Updated the Docker image to: demisto/python3:3.10.14.98889.

Related pull requests:
- 34985

Download

1.15.14 - 1109876 (June 21, 2024)

Scripts

PrintToParentIncident

Fixed an issue where the misnamed, recently-released PrintToParentAlert script was uploaded. It is no longer available, use PrintToParentIncident instead.
- Updated the Docker image to: demisto/python3:3.10.14.98471.

CreateEmailHtmlBody

Fixed an issue where the alerts field was not mapped in Cortex XSIAM.

Related pull requests:
- 34966

Download

1.15.12 - 1104278 (June 19, 2024)

Scripts

FailedInstances

Fixed an issue where the script failed when a ServiceNow v2 instance was configured with OAuth flow enabled.

Related pull requests:
- 34871

Download

1.15.11 - 1103228 (June 18, 2024)

Scripts

ReadPDFFileV2

Fixed an issue where the script failed to open and extract the PDF's data.
Updated the Docker image to: demisto/readpdf:1.0.0.98214.

Related pull requests:
- 34908

Download

1.15.10 - 1098002 (June 17, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Added support for parsing grouped shapes in power point files.

Related pull requests:
- 34876

Download

1.15.9 - 1089105 (June 13, 2024)

Scripts

GetIndicatorDBotScoreFromCache

Added support for additional special characters that were not escaped properly.

Related pull requests:
- 34818

Download

1.15.8 - 1084629 (June 10, 2024)

Scripts

New: PrintToAlert

Prints a value to the specified alert's war-room.

New: PrintToParentIncident

Prints a value to the parent incident's war-room of the current alert.

Related pull requests:
- 34765

Download

1.15.7 - 1082615 (June 10, 2024)

Common Scripts

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 34804

Download

1.15.6 - 1072918 (June 5, 2024)

Scripts

GetListRow

Fixed an issue where new lines at the end of the list could lead to an exception.
Updated the Docker image to: demisto/python3:3.10.14.96411.

Related pull requests:
- 34652

Download

1.15.5 - 1067546 (June 4, 2024)

Scripts

ExtractHyperlinksFromOfficeFiles

Fixed an issue where images with hyperlinks were not extracted properly from docx files.
Updated the Docker image to: demisto/office-utils:2.0.0.96781.

Related pull requests:
- 34671

Download

1.15.4 - 1063016 (June 2, 2024)

Scripts

FetchIndicatorsFromFile

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExifRead

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExtractDomainAndFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExtractFQDNFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

LanguageDetect

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

StixCreator

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ExtractDomainFromUrlAndEmail

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

ParseExcel

Updated the Docker image to: demisto/py3-tools:1.0.0.96102.

Related pull requests:
- 34465
- 33830
- 33831
- 33828
- 33825
- 33805
- 33871

Download

1.15.3 - 1057933 (May 30, 2024)

Scripts

GetIndicatorDBotScoreFromCache

Fixed an issue where not all special chars were escaped correctly.

Related pull requests:
- 34647

Download

1.15.2 - 1051712 (May 28, 2024)

Scripts

VerdictResult

Added support for Suspicious verdict.
Updated the Docker image to: demisto/python3:3.10.14.95956.

Related pull requests:
- 34575

Download

1.15.1 - 1049953 (May 28, 2024)

Scripts

GetIndicatorDBotScoreFromCache

Fixed an issue where some special chars of indicator values were not escaped correctly.
Updated the Docker image to: demisto/python3:3.10.14.95956.

Related pull requests:
- 34576

Download

1.15.0 - 1046017 (May 26, 2024)

Scripts

ZipFile

Replaced the pyminizip library with pyzipper.
Updated the Docker image to: demisto/py3-tools:1.0.0.95440.

Related pull requests:
- 34399

Download

1.14.49 - 1038463 (May 23, 2024)

Scripts

StixCreator

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34399
- 34484

Download

1.14.48 - 1029456 (May 20, 2024)

Scripts

ParseWordDoc

Updated the Docker image to: demisto/office-utils:2.0.0.93886.

SSDeepSimilarity

Updated the Docker image to: demisto/ssdeep:1.0.0.93570.

PreProcessImage

Updated the Docker image to: demisto/processing-image-file:1.0.0.93358.

AquatoneDiscoverV2

Updated the Docker image to: demisto/aquatone:2.0.0.93318.

PcapHTTPExtractor

Updated the Docker image to: demisto/pcap-http-extractor:1.0.0.93351.

ReadPDFFileV2

Updated the Docker image to: demisto/readpdf:1.0.0.93363.

ExtractIndicatorsFromWordFile

Updated the Docker image to: demisto/office-utils:2.0.0.93886.

PDFUnlocker

Updated the Docker image to: demisto/readpdf:1.0.0.93363.

Related pull requests:
- 34378

Download

1.14.47 - 1027410 (May 20, 2024)

Scripts

StixCreator

Fixed an issue in the TAXII2ApiModule related to TAXII2 server integration.

Related pull requests:
- 34434

Download

1.14.46 - 1021616 (May 16, 2024)

Scripts

ScheduleGenericPolling

Fixed an issue where polling didn't reach into timeouts.

Related pull requests:
- 34357

Download

1.14.45 - 1005026 (May 8, 2024)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 34251

Download

1.14.44 - 1000160 (May 7, 2024)

Scripts

ParseEmailFilesV2

Documentation and metadata improvements.
Updated the Docker image to: demisto/parse-emails:1.0.0.93148.

Related pull requests:
- 33388

Download

1.14.43 - 998827 (May 6, 2024)

Common Scripts

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 34212

Download

1.14.42 - R995825 (May 5, 2024)

Scripts

Ping

Improved the error message to clarify that the script can only run on a custom engine on Cortex XSOAR 8 and Cortex XSIAM.
Updated the Docker image to: demisto/netutils:1.0.0.92795.

Related pull requests:
- 34167

Download

1.14.41 - 986039 (May 1, 2024)

Scripts

DeleteContext

Fixed an issue where results' object, contents' format, did not match actual content type.

Related pull requests:
- 34132

Download

1.14.40 - 978880 (April 26, 2024)

Scripts

FormatURL

Internal code adjustments.
Updated the Docker image to: demisto/python3:3.10.14.92207.

FindSimilarIncidents

Deprecated. Use the DBotFindSimilarIncidents script instead.

Related pull requests:
- 33245

Download

1.14.38 - 978218 (April 25, 2024)

Scripts

CreateNewIndicatorsOnly

Added the associate_to_current argument which associates the indicator with the current incident.

Related pull requests:
- 33907

Download

1.14.37 - 976988 (April 25, 2024)

Scripts

ParseEmailFilesV2

Added support for Apple HFS file type.
Updated the Docker image to: demisto/parse-emails:1.0.0.93148.

Related pull requests:
- 34084

Download

1.14.36 - 971504 (April 21, 2024)

Scripts

ParseEmailFilesV2

Fixed an issue where some eml files where not recognized.

Related pull requests:
- 34081

Download

1.14.35 - 970211 (April 21, 2024)

Scripts

FormatURL

Fixed an issue with microsoft safe links not being formatted correctly when the link had office365.us as a domain or a path as part of the wrapper.

Related pull requests:
- 34050

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 27, 2020
Last Release	April 17, 2025

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.