Pack Contributors:
- Mandar Naik
- nikstuckenbrock
- Lizz Boice
- Ali Sawyer
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
A pack that contains community scripts
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
Contributions are welcome and appreciated. For more info, visit our Contribution Guide.
Name | Description |
---|---|
BatchData | This Automation takes in a string of comma separated items and returns a dictionary of with the defined chunk size. |
CreateEDLInstance | Use this automation to create an EDL instance on XSOAR. |
GetFilePathPreProcessing | This is a pre-processing script that is used to create the attachments of incoming incidents in an existing incident, then drop the incoming incident. |
GetIndicatorDBotScoreFromContext | Get the final verdict from the DBotScore of the context. |
StripAccentMarksFromString | Strip accent marks (diacritics) from a given string. |
RetrievePlaybooksAndIntegrations | Deprecated. Use RetrievePlaybookDependencies instead. Retrieves all Playbook (and Sub-Playbook) Names and Integrations for a provided Playbook name |
DeleteIncidentsByQuery | Use this automation to delete incidents using query parameter with the same format as used in incidents search. Core REST API integration instance should be created. |
DateTimeNowToEpoch | Returns the current datetime as an epoch value for use in timestamp comparisons. |
redactindicator | Redactindicator can help you to defang/redact any kind of indicator (IPv4, url, domain and email), IP addresses will be in the dotted representation like 8.8.8[.].8, all domains will be example[.]com. Optional you can define a "searchkey" which does not to be case sensitive, which will be replaced as <REDACTED>. |
DateTimeToLDAPTime | Converts the given time to an LDAP timestamp. |
CreatePlbkDoc | Purpose: This automation will produce docx file detailing the tasks in the given playbook. It can produce a table or paragraph format of the report. Author: Mahmood Azmat Input1: Name of the playbook (Mandatory) Requirements: This automation requires "Core REST API" integration enabled and connected to the XSOAR itself. Automation uses it to read the objects of the playbook. |
CreateArrayWithDuplicates | Will create an array object in context from a given string input , allowing for duplicate values to be retained Output is to ContextKey.array as JSON does not permit duplicate key names e.g., ContextKey.array.value1, ContextKey.array.value2, ContextKey.array.value3, etc. |
RetrievePlaybookDependencies | Retrieves all Playbook (and Sub-Playbook) Names, Integrations, Automation Scripts, Commands not using-brand, and lists for a provided Playbook name. Also accepts inputs for incident types, layouts, incident fields, indicator fields, jobs, mappers, and pre-process rules connected to the parent playbook. Results can be output as an HTML or Markdown list. |
CompareList | Compares two lists. |
VersionEqualTo | Tests whether left side version number is equal to right side version number. |
FindPlaybookCustomDependencies | Find custom scripts and integration dependencies used inside of playbooks. |
RandomPhotoNasa | This automation script will pull a random image from https://images.nasa.gov based on the search parameter provided. If the script is used within a widget, it will output an image in markdown format. If it is used anywhere else it will output an image in markdown format and also context data. |
IPCalcCheckSubnetCollision | An automation script to return subnet collision result |
IPCalcReturnAddressIANAAllocation | An automation script to return address IANA information |
GetIndexOfArrayValue | This transformer will get an index of an element from an array. |
CreateFileFromPathObject | This automation is being executed by the "GetFilePathPreProcessing" pre-processing script that collects the paths and names of attachments of an incoming incident, then passes it to this automation that reads the files and creates them in an existing incident |
MissingElements | Returns the list of missing elements from an input list of integers. e.g. [12,14,16] -> [13,15]. |
ConvertUTCEpochTimeToTimeStamp | This transformer convert the Epoch or UTC timestamp to desired stamp |
isArrayItemInList | This automation is for comparing array(list) data of context to existing lists on XSOAR server. You can avoid using loop of sub-playbook. |
DeleteIndicators | Delete indicators based on query, values, or IDs. |
IPCalcReturnSubnetNetwork | An Automation Script to return subnet network ID |
SSLVerifier | Use this automation to check for validity of your SSL certificate and get the time until expiration. |
MaxList | Gets the maximum value from list |
GetListDatawithKeyword | This transformer will get list of array elements by providing keyword. List data format |
Json2HtmlTable | Converts JSON objects to HTML tables. |
MapRegex | This transformer will take in a value and transform it based on multiple regular expressions defined in a JSON dictionary structure. The key:value pair of the JSON dictionary should be: "desired outcome": "regex to match" For example: { The transformer will match in order of dictionary entries. |
VersionLessThan | Tests whether left side version number is less than right side version number. Version numbers need to have at least a major and minor version component to be considered valid. E.g. 1.0 |
DateTimeToADTime | Converts unix time to AD Integer8 time. This is used in many AD date fields like pwdLastSet. |
jq | Deprecated. Use JMESPath transformer from the Filters and Transformers content pack instead. |
RandomElementFromList | randomly select elements from a list in Python |
Defang | Defangs IP, Mail and URL address to prevent them from being recognized. |
GenerateRandomJSON | Generate a list of random dictionaries, using Faker Python library. For more information, please visit https://faker.readthedocs.io |
GetFields | Retrieves fields from an object using dot notation |
ExtFilter | Advanced Filter. It enables you to make filters with complex conditions. |
RemoveEmptyEvidence | The automation removes evidence based on a query performed on the evidence content, |
CalculateTimeSpan | Calculates the time span between two dates using Powershell's A timespan with a start date of "2022-04-02T15:42:48" and end date of "2022-04-12T16:55:07" would return the following: Days : 10 |
PHash | Script to create a perceptual hash of an image (or file) stored in the incident. Wrapps https://pypi.org/project/ImageHash/ |
VersionGreaterThan | Tests whether left side version number is greater than right side version number. Version numbers need to have at least a major and minor version component to be considered valid. E.g. 1.0 |
GetIndicatorCustomFieldsByQuery | Returns indicator custom fields into the context by the given query. |
MarkdownToHTML | Converts Markdown to HTML. |
DisplayTaggedWarroomEntries | Display warroom entries in a dynamic section which are tagged with 'report' |
IPCalcReturnAddressBinary | An automation script to return address in binary format |
MinList | Gets the minimum value from list |
InvertEveryTwoItems | This transformer will invert every two items in an array. If the total of items in the array is an odd number the last item will be removed If the item is not an array the output will be same passed object. |
delete_expired_indicator_with_exlusion | deletes expired indicators. |
IPCalcReturnSubnetBroadcastAddress | An Automation Script to return subnet broadcast address |
GetAskLinks | Creates external ask links for the |
DisplayIndicatorReputationContent | Display the indicator context object in markdown format in a dynamic section layout |
IPCalcReturnSubnetAddresses | An automation script to return subnet addresses |
Name | Description |
---|---|
CompareList | Compares two lists. |
DateTimeNowToEpoch | Returns the current datetime as an epoch value for use in timestamp comparisons. |
MinList | Gets the minimum value from list |
jq | Deprecated. Use JMESPath transformer from the Filters and Transformers content pack instead. |
MissingElements | Returns the list of missing elements from an input list of integers. e.g. [12,14,16] -> [13,15]. |
GetIndexOfArrayValue | This transformer will get an index of an element from an array. |
GetFields | Retrieves fields from an object using dot notation |
MarkdownToHTML | Converts Markdown to HTML. |
CreatePlbkDoc | Purpose: This automation will produce docx file detailing the tasks in the given playbook. It can produce a table or paragraph format of the report. Author: Mahmood Azmat Input1: Name of the playbook (Mandatory) Requirements: This automation requires "Core REST API" integration enabled and connected to the XSOAR itself. Automation uses it to read the objects of the playbook. |
Json2HtmlTable | Converts JSON objects to HTML tables. |
DateTimeToLDAPTime | Converts the given time to an LDAP timestamp. |
GetIndicatorDBotScoreFromContext | Get the final verdict from the DBotScore of the context. |
IPCalcReturnAddressBinary | An automation script to return address in binary format |
FindPlaybookCustomDependencies | Find custom scripts and integration dependencies used inside of playbooks. |
CalculateTimeSpan | Calculates the time span between two dates using Powershell's A timespan with a start date of "2022-04-02T15:42:48" and end date of "2022-04-12T16:55:07" would return the following: Days : 10 |
IPCalcReturnAddressIANAAllocation | An automation script to return address IANA information |
VersionEqualTo | Tests whether left side version number is equal to right side version number. |
CreateFileFromPathObject | This automation is being executed by the "GetFilePathPreProcessing" pre-processing script that collects the paths and names of attachments of an incoming incident, then passes it to this automation that reads the files and creates them in an existing incident |
GenerateRandomJSON | Generate a list of random dictionaries, using Faker Python library. For more information, please visit https://faker.readthedocs.io |
IPCalcReturnSubnetBroadcastAddress | An Automation Script to return subnet broadcast address |
DisplayTaggedWarroomEntries | Display warroom entries in a dynamic section which are tagged with 'report' |
VersionGreaterThan | Tests whether left side version number is greater than right side version number. Version numbers need to have at least a major and minor version component to be considered valid. E.g. 1.0 |
CreateEDLInstance | Use this automation to create an EDL instance on XSOAR. |
RetrievePlaybookDependencies | Retrieves all Playbook (and Sub-Playbook) Names, Integrations, Automation Scripts, Commands not using-brand, and lists for a provided Playbook name. Also accepts inputs for incident types, layouts, incident fields, indicator fields, jobs, mappers, and pre-process rules connected to the parent playbook. Results can be output as an HTML or Markdown list. |
RetrievePlaybooksAndIntegrations | Deprecated. Use RetrievePlaybookDependencies instead. Retrieves all Playbook (and Sub-Playbook) Names and Integrations for a provided Playbook name |
BatchData | This Automation takes in a string of comma separated items and returns a dictionary of with the defined chunk size. |
IPCalcReturnSubnetAddresses | An automation script to return subnet addresses |
DeleteIndicators | Delete indicators based on query, values, or IDs. |
PHash | Script to create a perceptual hash of an image (or file) stored in the incident. Wrapps https://pypi.org/project/ImageHash/ |
redactindicator | Redactindicator can help you to defang/redact any kind of indicator (IPv4, url, domain and email), IP addresses will be in the dotted representation like 8.8.8[.].8, all domains will be example[.]com. Optional you can define a "searchkey" which does not to be case sensitive, which will be replaced as <REDACTED>. |
GetListDatawithKeyword | This transformer will get list of array elements by providing keyword. List data format |
StripAccentMarksFromString | Strip accent marks (diacritics) from a given string. |
isArrayItemInList | This automation is for comparing array(list) data of context to existing lists on XSOAR server. You can avoid using loop of sub-playbook. |
IPCalcCheckSubnetCollision | An automation script to return subnet collision result |
DateTimeToADTime | Converts unix time to AD Integer8 time. This is used in many AD date fields like pwdLastSet. |
RandomElementFromList | randomly select elements from a list in Python |
GetAskLinks | Creates external ask links for the |
SSLVerifier | Use this automation to check for validity of your SSL certificate and get the time until expiration. |
RandomPhotoNasa | This automation script will pull a random image from https://images.nasa.gov based on the search parameter provided. If the script is used within a widget, it will output an image in markdown format. If it is used anywhere else it will output an image in markdown format and also context data. |
RemoveEmptyEvidence | The automation removes evidence based on a query performed on the evidence content, |
CreateArrayWithDuplicates | Will create an array object in context from a given string input , allowing for duplicate values to be retained Output is to ContextKey.array as JSON does not permit duplicate key names e.g., ContextKey.array.value1, ContextKey.array.value2, ContextKey.array.value3, etc. |
GetFilePathPreProcessing | This is a pre-processing script that is used to create the attachments of incoming incidents in an existing incident, then drop the incoming incident. |
IPCalcReturnSubnetNetwork | An Automation Script to return subnet network ID |
InvertEveryTwoItems | This transformer will invert every two items in an array. If the total of items in the array is an odd number the last item will be removed If the item is not an array the output will be same passed object. |
ConvertUTCEpochTimeToTimeStamp | This transformer convert the Epoch or UTC timestamp to desired stamp |
ExtFilter | Advanced Filter. It enables you to make filters with complex conditions. |
MapRegex | This transformer will take in a value and transform it based on multiple regular expressions defined in a JSON dictionary structure. The key:value pair of the JSON dictionary should be: "desired outcome": "regex to match" For example: { The transformer will match in order of dictionary entries. |
MaxList | Gets the maximum value from list |
GetIndicatorCustomFieldsByQuery | Returns indicator custom fields into the context by the given query. |
DeleteIncidentsByQuery | Use this automation to delete incidents using query parameter with the same format as used in incidents search. Core REST API integration instance should be created. |
DeleteAlertsByQuery | Use this automation to delete alerts using query parameter with the same format as used in alerts search. Core REST API integration instance should be created. |
DisplayIndicatorReputationContent | Display the indicator context object in markdown format in a dynamic section layout |
delete_expired_indicator_with_exlusion | deletes expired indicators. |
Defang | Defangs IP, Mail and URL address to prevent them from being recognized. |
VersionLessThan | Tests whether left side version number is less than right side version number. Version numbers need to have at least a major and minor version component to be considered valid. E.g. 1.0 |
Pack Name | Pack By |
---|---|
Base | By: Cortex XSOAR |
Common Scripts | By: Cortex XSOAR |
Cortex REST API | By: Cortex XSOAR |
Pack Name | Pack By |
---|
Pack Name | Pack By |
---|---|
Cortex REST API | By: Cortex XSOAR |
Base | By: Cortex XSOAR |
Common Scripts | By: Cortex XSOAR |
Supported By | Community | |
Created | January 9, 2023 | |
Last Release | September 28, 2025 |